| View previous topic :: View next topic |
| Author |
Message |
krigav
Tux's lil' helper
Joined: 10 Nov 2005
Posts: 121
|
 Posted: Thu Jun 09, 2011 6:45 pm Post subject: listed IP in /etc/hosts.deny don't get blocked |
 |
|
I've a mail server running on a VPS using postfix+SASL. Everthing is working fine. Know I got attacked by some guys trying to get access my SMTP using brute force.
I've implemented IP blocking using fail2ban which will aadd the attacking IPs into /etc/hosts.deny. The attacker IP is listed in hosts.deny (ALL: 119.75.24.116) but I still receive login attempts. Why is the listed IP not blocked?
Thank you in advance for your help!
_________________
There are no dumb questions, just dumb answers. So please help users that are new to linux/gentoo by answering unanswered questions. |
|
| Back to top |
|
 |
Moriah
Advocate
Joined: 27 Mar 2004
Posts: 2386
Location: Kentucky
|
| Posted: Fri Jun 10, 2011 2:22 am Post subject: |
|
|
What does your /etc/hosts.allow look like, and what is your policy in your firewall pertaining to ALLOW/DENY for /etc/hosts.* ?
_________________
The MyWord KJV Bible tool is at http://www.elilabs.com/~myword
Foghorn Leghorn is a Warner Bros. cartoon character. |
|
| Back to top |
|
|
feystorm
Tux's lil' helper
Joined: 29 Jan 2004
Posts: 96
|
| Posted: Fri Jun 10, 2011 3:52 am Post subject: Re: listed IP in /etc/hosts.deny don't get blocked |
|
|
| krigav wrote: | I've a mail server running on a VPS using postfix+SASL. Everthing is working fine. Know I got attacked by some guys trying to get access my SMTP using brute force.
I've implemented IP blocking using fail2ban which will aadd the attacking IPs into /etc/hosts.deny. The attacker IP is listed in hosts.deny (ALL: 119.75.24.116) but I still receive login attempts. Why is the listed IP not blocked?
Thank you in advance for your help! |
/etc/hosts.deny and hosts.allow are tcpwrapper config files. Only things which support tcpwrappers will obey the restrictions placed in these files, and postfix does not use tcpwrappers, so this will not work.
If you want to block specific IPs, you'll either have to do it with postfix's smtpd_client_restrictions + check_client_access, or iptables. |
|
| Back to top |
|
|
Moriah
Advocate
Joined: 27 Mar 2004
Posts: 2386
Location: Kentucky
|
| Posted: Fri Jun 10, 2011 1:26 pm Post subject: |
|
|
I use iptables together with a file of ip addresses to block, and a script that adds them to the running iptables.
_________________
The MyWord KJV Bible tool is at http://www.elilabs.com/~myword
Foghorn Leghorn is a Warner Bros. cartoon character. |
|
| Back to top |
|
|
|
Networking & Security
