Ask HN: How do you protect your Mailserver from DDoS Attacks?

Re:Ask HN: How do you protect your Mailserver from DDoS Atta... by tmikaeld on Friday August 14, 2020 @04:00AM (#24155130)

You can setup fail2ban to permanently add brute-force tries to a proper firewall, like cloudflare.

That's how I've set it up. If they try to login 30 times in an 1 hour, then it's definitely not a legit user in any case.

When it's blocked on the firewall level, before it reach your server, then your server don't need to handle the request at all.

[ Parent | on HN ]

Re:Ask HN: How do you protect your Mailserver from DDoS Atta... by zimpenfish on Friday August 14, 2020 @04:47AM (#24155470)

> If they try to login 30 times in an 1 hour, then it's definitely not a legit user in any case.

I have

* `exim-usernames` - 10 day ban instantly for anyone trying to login with a specific set of usernames (227 currently banned)

* `exim-aggressive` - 4h ban for repeated failures (SSL, EHLO, etc.) (7 currently banned)

* `exim-spam` - 4h ban for repeated spam rejections. (0 currently banned)

Plus `rspamd` for greylisting, honeypot addresses, etc.

[ Parent | on HN ]