My SMTP server is being probed. It looks like a brute force attach on SASL, where they're going through a password dictionary.Having seen thousands of these lines in the log filesSep 18 14:09:52 xxx postfix/smtpd[7412]: connect from ca255.calcit.fastwebserver.de[146.0.42.124]Sep 18 14:09:55 xxx postfix/smtpd[7412]: warning: ca255.calcit.fastwebserver.de[146.0.42.124]: SASL LOGIN authentication failed: authentication failureSep 18 14:09:55 xxx postfix/smtpd[7412]: lost connection after AUTH from ca255.calcit.fastwebserver.de[146.0.42.124]Sep 18 14:09:55 xxx postfix/smtpd[7412]: disconnect from ca255.calcit.fastwebserver.de[146.0.42.124]I modified my main.cf like this:inet_interfaces = allsmtpd_sasl_auth_enable=yessmtpd_helo_required = yessmtpd_sender_restrictions = reject_unknown_addresssmtpd_client_restrictions =  check_client_access hash:/etc/postfix/maps/access_client,                             permit_mynetworks,                             rejectsmtpd_recipient_restrictions = check_client_access hash:/etc/postfix/maps/access_client,                               permit_mynetworks,                               reject_non_fqdn_sender,                               reject_non_fqdn_recipient,                               reject_unknown_sender_domain,                               reject_unknown_recipient_domain,                               permit_sasl_authenticated,                               reject_unauth_pipelining,                               reject_unauth_destination,                               reject_rbl_client zen.spamhaus.org,                               reject_rbl_client list.dsbl.org                               permitbroken_sasl_auth_clients = yesAnd my /etc/postfix/maps/access_client only has this line:146.0.42.124 REJECTHowever after restarting postfix there is still no change in behaviour, I still see the same error, so SASL is still being checked, even though I thought with these settings the client would be rejected based on its IP address before SASL even comes into the game ?A 2nd question is - I am relaying outgoing mail traffic from one machine to another on the internal network - apart from the 'relayhost' setting on the machine that just relays, can I keep the rest of the postfix settings the same on both ?
Why doesn't Postfix reject a specific client's connection attempts?
firewall;postfix;smtp;sasl
Postfix doesn't evaluate the smtpd_client_restrictions until the RCPT TO (or ETRN) command is sent.http://www.postfix.org/SMTPD_ACCESS_README.html#timingCurrent Postfix versions postpone the evaluation of client, helo and sender restriction lists until the RCPT TO or ETRN command. This behavior is controlled by the smtpd_delay_reject parameter. Restriction lists are still evaluated in the proper order of (client, helo, etrn) or (client, helo, sender, relay, recipient, data, or end-of-data) restrictions. When a restriction list (example: client) evaluates to REJECT or DEFER the restriction lists that follow (example: helo, sender, etc.) are skipped.Thus you can get around this by setting the following in your main.cf:smtpd_delay_reject = no As for your second question, there are so many controls for postfix, this is near impossible to answer without having complete details of your network, postfix configuration, and client configuration. Best way is to just try it.