Re: Blocking access before SASL

2015-06-14 Thread Wietse Venema
CBL: > > Instead, use postscreen. It blocks clients before they are allowed > > to talk to a Postfix SMTP server. > > > > /etc/postfix/main.cf: > > postscreen_greet_action = enforce > > postscreen_dnsbl_action = enforce > > postscreen_dnsbl_sites = ...your DNSBL server here... > > > > Y

Re: Blocking access before SASL

2015-06-13 Thread CBL
> Instead, use postscreen. It blocks clients before they are allowed > to talk to a Postfix SMTP server. > > /etc/postfix/main.cf: > postscreen_greet_action = enforce > postscreen_dnsbl_action = enforce > postscreen_dnsbl_sites = ...your DNSBL server here... > > You can use rbldnsd to r

Re: Blocking access before SASL

2015-06-13 Thread Noel Jones
On 6/13/2015 6:33 PM, Benny Pedersen wrote: > wie...@porcupine.org skrev den 2015-06-14 01:02: > >> /etc/postfix/main.cf: >> postscreen_greet_action = enforce >> postscreen_dnsbl_action = enforce >> postscreen_dnsbl_sites = ...your DNSBL server here... > > could postscreen be extended

Re: Blocking access before SASL

2015-06-13 Thread Benny Pedersen
wie...@porcupine.org skrev den 2015-06-14 01:02: /etc/postfix/main.cf: postscreen_greet_action = enforce postscreen_dnsbl_action = enforce postscreen_dnsbl_sites = ...your DNSBL server here... could postscreen be extended to sqlite dnsbl sites ?, to slow ? i thinking fail2ban upda

Re: Blocking access before SASL

2015-06-13 Thread Wietse Venema
CBL: > Having a lot of dictionary attacks working on guessing login details. I'm > wondering if there's an easy way to block access to specific IPs prior to > SASL authentication? There is no smtpd_sasl_restictions feature, and it is unlikely to be implemented. Instead, use postscreen. It blocks