The es-postfix module was developed by Extra Systems to protect the postfix mail server from hacker and spammer activity within the fail2ban system. Its purpose is to detect suspicious activity in the /var/log/mail.log file.
To connect es-postfix to fail2ban, use the following configuration:
[es-postfix] enabled = true filter = es-postfix logpath = /var/log/mail.log action = iptables-allports[name=es-postfix, blocktype=DROP, protocol=all]
Please note that this filter blocks all protocols on all ports for the identified hacker (or spammer), using the DROP method. This turns your host into a complete "black hole" for this particular attacker. They will not receive any response to any subsequent IP packets. This approach significantly reduces the load on your server's resources.
The code for our es-postfix filter looks like this:
[Definition]
failregex = ^.*postfix/smtpd\[\d+\]: disconnect from unknown\[<HOST>\]\s
^.*dovecot: (?:imap|pop3)-login: Disconnected: Connection closed \(no auth attempts in \d+ secs\): user=<>, rip=<HOST>, lip=.*$
^.*dovecot: (?:imap|pop3)-login: Disconnected: Connection closed: read\(size=\d+\) failed: Connection reset by peer \(no auth attempts in \d+ secs\): user=<>, rip=<HOST>, lip=.*$
^.*postfix/(?:submission/)?smtpd\[\d+\]: disconnect from \S+\[<HOST>\] commands=0/0$
^.*postfix/smtpd\[\d+\]: NOQUEUE: reject: RCPT from unknown\[<HOST>\]: 450 4.7.1 Client host rejected: cannot find your reverse hostname.*$
^.*dovecot: imap-login: Disconnected: Connection closed: SSL_accept\(\) failed:.*rip=<HOST>, lip=.*$
^.*postfix/smtpd\[\d+\]: warning: hostname \S+ does not resolve to address <HOST>: Name or service not known$
^.*postfix/smtpd\[\d+\]: NOQUEUE: reject: RCPT from unknown\[<HOST>\]: 450 4.7.25 Client host rejected: cannot find your hostname.*$
^.*postfix/smtpd\[\d+\]: warning: \S+\[<HOST>\]: SASL LOGIN authentication failed: authentication failure$
^.*postfix/smtpd\[\d+\]: NOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5.7.1 Service unavailable; Client host \[\S+\] blocked using .*$
^.*postfix/(?:submission/)?smtpd\[\d+\]: warning: non-SMTP command from \S+\[<HOST>\]: .*$
^.*postfix/submission/smtpd\[\d+\]: disconnect from \S+\[<HOST>\] ehlo=0/1 commands=0/1$
ignoreregex =
In practical use on our Linux servers, this filter has proven to be very effective in suppressing hacker and spammer activity within the postfix mail server.
The content of this page is also available in Russian.
| © Extra Systems, 2026 |
|