Hallo,
ist es möglich, postscreen so zu konfigurieren, dass es vor einem Disconnect die Verbindung noch eine Weile bestehen lässt, um den Angreifer eine Weile zu beschäftigen?
Hintergrund: ich sehe gerade in meinem Log folgende Versuche Spam abzuladen:
Mar 6 12:20:23 s3 postfix/postscreen[13898]: CONNECT from [109.160.96.102]:62525 to [78.47.47.89]:25
Mar 6 12:20:23 s3 postfix/postscreen[13898]: PREGREET 14 after 0.04 from [109.160.96.102]:62525: EHLO ylmf-pc\r\n
Mar 6 12:20:24 s3 postfix/dnsblog[13900]: addr 109.160.96.102 listed by domain zen.spamhaus.org as 127.0.0.4
Mar 6 12:20:24 s3 postfix/postscreen[13898]: DNSBL rank 2 for [109.160.96.102]:62525
Mar 6 12:20:24 s3 postfix/postscreen[13898]: HANGUP after 0.08 from [109.160.96.102]:62525 in tests after SMTP handshake
Mar 6 12:20:24 s3 postfix/postscreen[13898]: DISCONNECT [109.160.96.102]:62525
Mar 6 12:20:24 s3 postfix/postscreen[13898]: CONNECT from [109.160.96.102]:62604 to [78.47.47.89]:25
Mar 6 12:20:24 s3 postfix/dnsblog[13901]: addr 109.160.96.102 listed by domain zen.spamhaus.org as 127.0.0.4
Mar 6 12:20:24 s3 postfix/postscreen[13898]: PREGREET 14 after 0.04 from [109.160.96.102]:62604: EHLO ylmf-pc\r\n
Mar 6 12:20:24 s3 postfix/postscreen[13898]: DNSBL rank 2 for [109.160.96.102]:62604
Mar 6 12:20:24 s3 postfix/postscreen[13898]: HANGUP after 0.08 from [109.160.96.102]:62604 in tests after SMTP handshake
Mar 6 12:20:24 s3 postfix/postscreen[13898]: DISCONNECT [109.160.96.102]:62604
Mar 6 12:20:25 s3 postfix/postscreen[13898]: CONNECT from [109.160.96.102]:62618 to [78.47.47.89]:25
Mar 6 12:20:25 s3 postfix/dnsblog[13900]: addr 109.160.96.102 listed by domain zen.spamhaus.org as 127.0.0.4
Mar 6 12:20:25 s3 postfix/postscreen[13898]: PREGREET 14 after 0.04 from [109.160.96.102]:62618: EHLO ylmf-pc\r\n
Mar 6 12:20:25 s3 postfix/postscreen[13898]: DNSBL rank 2 for [109.160.96.102]:62618
Mar 6 12:20:25 s3 postfix/postscreen[13898]: HANGUP after 0.08 from [109.160.96.102]:62618 in tests after SMTP handshake
Mar 6 12:20:25 s3 postfix/postscreen[13898]: DISCONNECT [109.160.96.102]:62618
Mar 6 12:20:25 s3 postfix/postscreen[13898]: CONNECT from [109.160.96.102]:62631 to [78.47.47.89]:25
Mar 6 12:20:25 s3 postfix/dnsblog[13900]: addr 109.160.96.102 listed by domain zen.spamhaus.org as 127.0.0.4
Mar 6 12:20:25 s3 postfix/postscreen[13898]: PREGREET 14 after 0.04 from [109.160.96.102]:62631: EHLO ylmf-pc\r\n
Mar 6 12:20:25 s3 postfix/postscreen[13898]: DNSBL rank 2 for [109.160.96.102]:62631
Mar 6 12:20:25 s3 postfix/postscreen[13898]: HANGUP after 0.08 from [109.160.96.102]:62631 in tests after SMTP handshake
Mar 6 12:20:25 s3 postfix/postscreen[13898]: DISCONNECT [109.160.96.102]:62631
Mar 6 12:20:25 s3 postfix/postscreen[13898]: CONNECT from [109.160.96.102]:62642 to [78.47.47.89]:25
Mar 6 12:20:25 s3 postfix/dnsblog[13899]: addr 109.160.96.102 listed by domain zen.spamhaus.org as 127.0.0.4
Mar 6 12:20:25 s3 postfix/postscreen[13898]: PREGREET 14 after 0.04 from [109.160.96.102]:62642: EHLO ylmf-pc\r\n
Mar 6 12:20:25 s3 postfix/postscreen[13898]: DNSBL rank 2 for [109.160.96.102]:62642
Mar 6 12:20:25 s3 postfix/postscreen[13898]: HANGUP after 0.08 from [109.160.96.102]:62642 in tests after SMTP handshake
Mar 6 12:20:25 s3 postfix/postscreen[13898]: DISCONNECT [109.160.96.102]:62642
Mar 6 12:20:25 s3 postfix/postscreen[13898]: CONNECT from [109.160.96.102]:62649 to [78.47.47.89]:25
Mar 6 12:20:25 s3 postfix/dnsblog[13899]: addr 109.160.96.102 listed by domain zen.spamhaus.org as 127.0.0.4
Mar 6 12:20:25 s3 postfix/postscreen[13898]: PREGREET 14 after 0.04 from [109.160.96.102]:62649: EHLO ylmf-pc\r\n
Mar 6 12:20:25 s3 postfix/postscreen[13898]: DNSBL rank 2 for [109.160.96.102]:62649
Mar 6 12:20:25 s3 postfix/postscreen[13898]: HANGUP after 0.08 from [109.160.96.102]:62649 in tests after SMTP handshake
Mar 6 12:20:25 s3 postfix/postscreen[13898]: DISCONNECT [109.160.96.102]:62649
Mar 6 12:20:25 s3 postfix/postscreen[13898]: CONNECT from [109.160.96.102]:62665 to [78.47.47.89]:25
Mar 6 12:20:25 s3 postfix/dnsblog[13899]: addr 109.160.96.102 listed by domain zen.spamhaus.org as 127.0.0.4
Mar 6 12:20:25 s3 postfix/postscreen[13898]: PREGREET 14 after 0.04 from [109.160.96.102]:62665: EHLO ylmf-pc\r\n
Mar 6 12:20:25 s3 postfix/postscreen[13898]: DNSBL rank 2 for [109.160.96.102]:62665
Mar 6 12:20:25 s3 postfix/postscreen[13898]: HANGUP after 0.08 from [109.160.96.102]:62665 in tests after SMTP handshake
Mar 6 12:20:25 s3 postfix/postscreen[13898]: DISCONNECT [109.160.96.102]:62665
Mar 6 12:20:25 s3 postfix/postscreen[13898]: CONNECT from [109.160.96.102]:62680 to [78.47.47.89]:25
Mar 6 12:20:25 s3 postfix/dnsblog[13899]: addr 109.160.96.102 listed by domain zen.spamhaus.org as 127.0.0.4
Mar 6 12:20:25 s3 postfix/postscreen[13898]: PREGREET 14 after 0.04 from [109.160.96.102]:62680: EHLO ylmf-pc\r\n
Mar 6 12:20:25 s3 postfix/postscreen[13898]: DNSBL rank 2 for [109.160.96.102]:62680
Mar 6 12:20:25 s3 postfix/postscreen[13898]: HANGUP after 0.08 from [109.160.96.102]:62680 in tests after SMTP handshake
Mar 6 12:20:25 s3 postfix/postscreen[13898]: DISCONNECT [109.160.96.102]:62680
Mar 6 12:20:25 s3 postfix/postscreen[13898]: CONNECT from [109.160.96.102]:62692 to [78.47.47.89]:25
Mar 6 12:20:25 s3 postfix/dnsblog[13899]: addr 109.160.96.102 listed by domain zen.spamhaus.org as 127.0.0.4
Mar 6 12:20:25 s3 postfix/postscreen[13898]: PREGREET 14 after 0.04 from [109.160.96.102]:62692: EHLO ylmf-pc\r\n
Mar 6 12:20:25 s3 postfix/postscreen[13898]: DNSBL rank 2 for [109.160.96.102]:62692
Mar 6 12:20:26 s3 postfix/postscreen[13898]: HANGUP after 0.08 from [109.160.96.102]:62692 in tests after SMTP handshake
Mar 6 12:20:26 s3 postfix/postscreen[13898]: DISCONNECT [109.160.96.102]:62692
Bevor mein fail2ban die Chance hatte die IP zu blocken, hat der Spammer schon etliche Wiederholungsversuche gemacht. Das möchte ich ein bisschen hinauszögern. Kein Spammer soll mehr als 3 Versuche bekommen. ;-)
Gruss Jochen