You are welcome, talk where you want but do that without me

thread for my disappointing:
viewtopic.php?f=22&t=10480

Oct  5 14:50:59 netstar postfix/smtpd[3849]: lost connection after UNKNOWN from unknown[220.172.191.30]
Oct  5 14:50:59 netstar postfix/smtpd[3849]: disconnect from unknown[220.172.191.30]
Oct  5 14:51:00 netstar dovecot: pop3-login: Disconnected (tried to use disabled plaintext auth): rip=220.172.191.30, lip=97.107.132.51
Oct  5 14:51:01 netstar postfix/smtpd[3849]: connect from unknown[220.172.191.30]
Oct  5 14:51:01 netstar postfix/smtpd[3849]: lost connection after UNKNOWN from unknown[220.172.191.30]
Oct  5 14:51:01 netstar postfix/smtpd[3849]: disconnect from unknown[220.172.191.30]
Oct  5 14:51:02 netstar dovecot: pop3-login: Disconnected (tried to use disabled plaintext auth): rip=220.172.191.30, lip=97.107.132.51

I'm again under attack but this time my postfix is saying fuckoff to them, damn bastards.
I'm receving hundred of message like the one I quoted in the maillog.
Now I banned that IP with iptables.
I need to add a rule in fail2ban to ban this type of request.
Have you got an idea on how to add a rule in fail2ban to ban this kind of request?

Something like this:

/etc/fail2ban/filter.d/dovecot-pop3imap.conf

[Definition]
failregex = (?: pop3-login|imap-login): (?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
ignoreregex =


/etc/fail2ban/jail.conf

[dovecot-pop3imap]
enabled = true
filter = dovecot-pop3imap
action = iptables-multiport[name=dovecot-pop3imap, port="110,995,143,993", protocol=tcp]
         sendmail-whois[name=DOVECOT, dest=me@example.com]
logpath = /var/log/mail.log
maxretry = 3
findtime = 300
bantime  = 1800

Edit as necessary of course....

_________________
sleddog

I'm analyzing the maillog when my server was attacked and when it was sending spam,
in the maillog I have thousands of lines like this:





and there is hundred of mail like this that confirms that they used postfix to send out the spam:




Don't understand what QMGR is and how they have sent message from test@members.linode.com using my VPS while I don't have test user and my domain name is not related with linode.com

I added this:
reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_destination
to the
smtpd_sender_restrictions
after the attack, do you think that that was the cause of the connection from the test account?
I haven't set that restrictions when I was attacked. Do you think that this was the cause?
I haven't any test account on my system.