News for hackers. Stuff that matters.

A comment on Ask HN: How do you protect your Mailserver from DDoS Attacks?. Parent comment

Re:Ask HN: How do you protect your Mailserver from DDoS Atta... by Wronnay on Friday August 14, 2020 @03:43AM (#24155010)
They are trying to brute passwords and i found out my fail2ban settings are too low - fail2ban detected them but the ban time wasn't long enough
[ Parent | on HN ]
Re:Ask HN: How do you protect your Mailserver from DDoS Atta... by tmikaeld on Friday August 14, 2020 @04:00AM (#24155130)
You can setup fail2ban to permanently add brute-force tries to a proper firewall, like cloudflare.

That's how I've set it up. If they try to login 30 times in an 1 hour, then it's definitely not a legit user in any case.

When it's blocked on the firewall level, before it reach your server, then your server don't need to handle the request at all.

[ Parent | on HN ]
Re:Ask HN: How do you protect your Mailserver from DDoS Atta... by zimpenfish on Friday August 14, 2020 @04:47AM (#24155470)
> If they try to login 30 times in an 1 hour, then it's definitely not a legit user in any case.

I have

* `exim-usernames` - 10 day ban instantly for anyone trying to login with a specific set of usernames (227 currently banned)

* `exim-aggressive` - 4h ban for repeated failures (SSL, EHLO, etc.) (7 currently banned)

* `exim-spam` - 4h ban for repeated spam rejections. (0 currently banned)

Plus `rspamd` for greylisting, honeypot addresses, etc.

[ Parent | on HN ]