cscli scenarios install Guezli/postfix-sasl-bfDetects slow or distributed SASL authentication bruteforce attempts against
postfix. Covers all SASL mechanisms parsed by crowdsecurity/postfix-logs
(LOGIN, PLAIN, CRAM-MD5, DIGEST-MD5).
The official crowdsecurity/postfix-spam scenario is tuned for fast spam waves
(capacity: 5, leakspeed: 10s). This scenario covers the opposite threat
model: distributed attackers each performing 1-2 SASL auth attempts per hour
across many IPs in a /24, where the fast-pattern bucket leaks faster than it
fills.
Threshold: 3 SASL auth failures from the same IP within ~2h -> ban.
crowdsecurity/postfix-logs parser (part of the crowdsecurity/postfix
collection)For Mailcow's postfix container:
1source: docker2container_name:3 - mailcowdockerized-postfix-mailcow-14labels:5 type: syslog
For a standalone postfix with file-based syslog:
1filenames:2 - /var/log/mail.log3labels:4 type: syslog
behavior label is pop3/imap:bruteforce because the hub taxonomy has
no dedicated smtp:bruteforce entry. This follows the precedent set by
hitech95/email-generic-bf.crowdsecurity/postfix-spam, which catches fast-pattern spam
waves; this one fills the slow / distributed gap.1# Detect slow / distributed SASL authentication bruteforce against postfix.2#3# Covers all SASL mechanisms parsed by `crowdsecurity/postfix-logs`4# (LOGIN, PLAIN, CRAM-MD5, DIGEST-MD5).5#6# The official `crowdsecurity/postfix-spam` scenario is tuned for fast7# spam waves (capacity 5 / leak 10s). It misses distributed bruteforces8# where many IPs each try only a couple of times per hour, because the9# bucket leaks faster than it fills.10#11# This scenario uses a much slower leak so a single IP that fails12# 3+ SASL auth attempts within ~2h triggers a ban.13#14# Requires the official `crowdsecurity/postfix-logs` parser, which15# already extracts source_ip from lines like:16# "warning: unknown[<IP>]: SASL <MECH> authentication failed: ..."1718type: leaky19name: Guezli/postfix-sasl-bf20description: "Detect slow / distributed SASL bruteforce against postfix"21filter: |22 evt.Meta.log_type == 'postfix'23 && evt.Parsed.message contains 'SASL'24 && evt.Parsed.message contains 'authentication failed'25groupby: evt.Meta.source_ip26# bucket holds 2 tokens, leaks 1 token every 2h27# => 3 fails within ~2h overflow the bucket28capacity: 229leakspeed: 7200s30blackhole: 2h31labels:32 service: postfix33 remediation: true34 confidence: 335 spoofable: 036 classification:37 - attack.T111038 behavior: "pop3/imap:bruteforce"39 label: "Postfix SASL Bruteforce"40references:41 - https://www.postfix.org/SASL_README.html42 - https://hub.crowdsec.net/author/crowdsecurity/collections/postfix43