Content
- Log parsers2
- Attack scenarios4
Postfix - Bruteforce Protection
Collection
- Version
- 0.5
- Name
- crowdsecurity/postfix
postfix support : parser and spammer detection
Install with a top-level collection
2 collections include itsudo cscli collections install crowdsecurity/apiscpInstalls 9 parsers and 56 scenarios.
View ApisCP →Installation
sudo cscli collections install crowdsecurity/postfixThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: crowdsecurity/postfixparsers:- crowdsecurity/postfix-logs- crowdsecurity/postscreen-logsscenarios:- crowdsecurity/postfix-spam- crowdsecurity/postfix-relay-denied- crowdsecurity/postfix-helo-rejected- crowdsecurity/postfix-non-smtp-commanddescription: "postfix support : parser and spammer detection"labels:label: "Postfix - Bruteforce Protection"author: crowdsecuritytags:- security_engine- linux- spam- bruteforce
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
Postfix collection
A collection for postfix
- postfix log parsers
- postscreen log parser
- postfix scenario bruteforce spam attempt
- postscreen rb attempt blacklist
This collection mostly aims at getting a similar spam protection as the normal fail2ban postfix configuration although postscreen log management isn't included by default by fail2ban.
Acquisition template
Example acquisition for this collection :
1filenames:2 - /var/log/mail.log3labels:4 type: syslog
notes :
- If you are using
syslog, set type tosysloginstead - Depending on your distribution/OS, paths to log files might change
- Only relevant if you are manually installing collection