Unauthenticated client/bot prevention

[pplulee]

Recently my logs have been showing a large number of machine scripts accessing the SMTP port that don't authenticate and try to send mail, taking up a lot of resources.

I've tried using fail2ban for protection(#1255), but the situation is different to failed authentication attempts(#1182), currently the log context needs to be analysed to get the attacker's IP address.

Is there any solution to prevent this kind of attack, or is it possible to improve the error log display to fit the simple regex?

[Pacerino]

This is the solution with fail2ban i'm using to prevent bot spamming looking for open relays.
#1187 (comment)

[pplulee]

Thanks for the help, but things are a little different here. The attack pattern I met is bot only sends lots of 'RCPT TO' commands before authentication, and then disconnects. The IP of the attacker client can only be found when it establishes the connection. Fail2ban cannot fit this log pattern(although I wrote a script to monitor the log and use fail2ban to ban IPs).

I wonder if it is possible to improve the format of 'Authentication error'?

[Pacerino]

I see multiple approaches here:

1. Add a log entry with the ip address when the 530 Authentication required will be send https://github.com/postalserver/postal/blob/main/lib/postal/smtp_server/client.rb#L353
2. Add the client ip to each log entry https://github.com/postalserver/postal/blob/main/lib/postal/smtp_server/client.rb#L101
3. Finally: this procedure would not require a change to the code. Each connection/log entry is provided with a unique ID. What you could do would be to use the ID to get the IP address and then count the error message 530 Authentication required per ID. If this value is exceeded, the IP address belonging to this ID is simply blocked.

[Pacerino]

Adding log "\e[33m WARN: AUTH failure for #{@ip_address}\e[0m" above this line https://github.com/postalserver/postal/blob/main/lib/postal/smtp_server/client.rb#L353 would show an warning with the client ip address. The same line is used in failed authentication, therefore the fail2ban jail should also work for that.

[pplulee]

This is an effective workaround. After I added the output error message, fail2ban can easily identify the log and ban the IP.