ASSP Filter Update

Added/Updated detection of:

* RelayAttempt (Scanners looking for open relays, drop to reduce attack surface)
* Auth error (Brute Force attempts, drop to reduce attack surface)
* Too frequent connections (Seen when attempting to deliver SPAM or Brute Force, drop to reduce server load)

Regex lines 12-14 are untested with newest release of ASSP. I personally have not seen anything in my logs that is caught by the Regex (For ASSP1?). 

ASSP Homepage has been down for a while, falling back the Sourceforge project page.

Fixed spelling

I recommend setting the ban time for ASSP to 2+ hours.  

On Thu, 19 Jun 2014, Mark Lopez wrote:
>    In config/filter.d/assp.conf:

>  > @@ -12,13 +12,40 @@ __assp_actions = (?:dropping|refusing)
>  >  failregex = ^(:? \[SSL-out\])? <HOST> max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$
>  >                    ^(?: \[SSL-out\])? <HOST> SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$
>  >                    ^ Blocking <HOST> - too much AUTH errors \(\d{,3}\);$
>  > -
>  > +                  ^ \[RelayAttempt\] <HOST> \<\S+@\S+\.\S+\> relay attempt blocked for: .+
>  > +                  ^ <HOST> \[SMTP Error\] 535 5\.7\.8 Error: authentication failed: authentication failure
>  > +                  ^ <HOST> \<\S+@\S+\.\S+\> \[SMTP Error\] 554 5\.7\.1 too frequent connections for '.+'

>    The blocking limit is configurable within ASSP - or can be disabled
>    entirely (e.g. Gmail only, etc.). I have never seen a server that opens
>    10+ concurrent connections to ASSP when attempting to deliver legit mail.

couldn't it be a server hosting organization where multiple
(hundreds?) users come through the same gateway to the assp proxy?

-- 
Yaroslav O. Halchenko, Ph.D.
http://neuro.debian.net http://www.pymvpa.org http://www.fail2ban.org
Research Scientist,            Psychological and Brain Sciences Dept.
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
Phone: +1 (603) 646-9834                       Fax: +1 (603) 646-1419
WWW:   http://www.linkedin.com/in/yarik