fail2ban/fail2ban — Issue #20: Filters for sendmail - hackers and spammers
Author: cepheid666
Created: 2011-12-30 07:57:58+00:00
State: open

There don't appear to be any default filters for sendmail, so I thought I'd contribute a couple. The first one is to ban people who attempt to brute-force SMTP AUTH. This doesn't work wonderfully since not all brute-force attempts can be captured by the particular regex I'm using, but it catches a few. Ideally, one would use some other method (e.g. checking saslauthd logs) which would do a better job, but this is not always possible - for example, CentOS servers default to using saslauthd via PAM, and the current CentOS-packaged version of saslauthd (in all current CentOS dists) does not properly pass the "remotehost" parameter to PAM, so the saslauthd PAM errors are useless for fail2ban monitoring. Thus, in the default configuration, the only way to use fail2ban to kick out sendmail brute-force hackers is the following. (Another alternative is to set saslauthd's syslog level to "debug," but that adds a lot of length to logfiles and is not an out-of-the-box configuration.)

The second filter is to lock out spammers who are looking for open relays. Many spammers don't bother to "test the waters" on a server to check for an open relay - they usually just attempt to flood the server with dozens, even hundreds, of spam messages, simply hoping that the server is an open relay and will pass it on, and not caring if it's not. The filter included below checks for repeated "open relay" probes and locks out the offenders who are trying to use the server as a spambot. (Of course, this works only if you've actually locked down your server and disabled relaying without auth.)

sendmail brute-force hack filter - sendmail.conf:

```
# Fail2Ban configuration file
#
# Author: Jamie Morrison; minor modifications by Amir Caspi
# See http://theether.net/kb/100141
#
# $Revision: 1 $
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P[\w\-.^_]+)
# Values: TEXT
#
failregex = \[\]: possible SMTP attack: command=AUTH

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
```

sendmail spam relay filter - sendmail-relay.conf:

```
# Fail2Ban configuration file
#
# Author: Amir Caspi
#
# $Revision: 1 $
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

_daemon = sm-acceptingconnections

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P[\w\-.^_]+)
# Values: TEXT
#
failregex = ^%(__prefix_line)s\S*: ruleset=check_rcpt, arg1=\S*, relay=\S*\s*\[\], reject=550 5.7.1 <\S*>... Relaying denied. Proper authentication required.\s*$

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
```

And, the relevant jail.conf settings that I happen to use are:

```
[sendmail]

enabled = true
filter = sendmail
action = iptables-multiport[name=SENDMAIL, port="smtp,smtps,submission", protocol=tcp]
sendmail-whois-lines[name=SENDMAIL, dest=root, sender=fail2ban@mail.com, logpath=/var/log/maillog]
logpath = /var/log/maillog
# Once is enough for these jerks!
maxretry = 0

[sendmail-relay]

enabled = true
filter = sendmail-relay
action = iptables-multiport[name=SENDMAIL, port="smtp,smtps,submission", protocol=tcp]
sendmail-whois-lines[name=SENDMAILrelay, dest=root, sender=fail2ban@mail.com, logpath=/var/log/maillog]
logpath = /var/log/maillog
maxretry = 4
```

I hope these can be added to the default set of filters, as I think they would be quite useful - many still use sendmail and this has really helped to keep my sendmail hacks down to a minimum (particularly by tarpitting the damn spammers!).

Hope this helps.