a few days ago I've set up a VPS, including personal SMTP service using postfix + procmail under Debian / Wheezy.I am already seeing a LOT of hammering onto the SMTP and other ports. Here's an excerpt:Jul 31 09:06:25 [myserver] postfix/smtpd[15372]: warning: mail.thethirdroom.org[81.137.228.117]: SASL LOGIN authentication failed: authentication failure  Jul 31 10:00:02 [myserver] postfix/smtpd[20616]: warning: host245-192-static.36-88-b.business.telecomitalia.it[88.36.192.245]: SASL LOGIN authentication failed: authentication failureThere are multiple login attempts per second. Now, I am running sshguard to keep people from bruteforcing there (except if it was a distributed attempt), but postfix is still kind of vulnerable since sshguard does not support that.Can anyone hint me at how to make this thing more secure?Thanks a lot!TL;DR: SMTP server getting hammered, would like to ban IPs after n faulty attempts.
Protecting postfix from bruteforce attacks
security;postfix;smtp
Check out this tool Fail2Ban, it scans log files for malicious activity and fires off an event. There is bottled event handlers like creating a firewall to reject the offending IP, or you can make your own custom event handlers.