Postfix Helo Rejected
Attack scenariosmtp:spamMITRE T1595MITRE T1592
- Version
- 0.1
- Name
- crowdsecurity/postfix-helo-rejected
- Remediation
- Ban
Detect HELO rejections
Install with a top-level collection
2 collections include itsudo cscli collections install crowdsecurity/apiscpInstalls 9 parsers and 56 scenarios, via Postfix - Bruteforce Protection.
View ApisCP →Installation
sudo cscli scenarios install crowdsecurity/postfix-helo-rejectedThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
# postfix helo rejected because it did not match postfix restrictionstype: leakyname: crowdsecurity/postfix-helo-rejecteddescription: "Detect HELO rejections"filter: "evt.Meta.log_type == 'postfix' && evt.Meta.action == 'reject' && evt.Meta.reason startsWith 'Helo command rejected'"references:- https://www.postfix.org/postconf.5.html#smtpd_helo_restrictionsgroupby: evt.Meta.source_ipcapacity: 1leakspeed: 600sblackhole: 1mreprocess: falselabels:service: postfixremediation: trueconfidence: 2spoofable: 0classification:- attack.T1595- attack.T1592behavior: "smtp:spam"label: "Postfix Helo Rejected"
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
Postfix helo rejected
Postfix helo rejected is a log message generated when a client sends a HELO or EHLO command that is rejected by the server. This can happen for a variety of reasons, such as the client using an invalid hostname or the server being configured to reject certain types of HELO commands.
You can see the configuration for the restrictions placed on HELO commands within https://www.postfix.org/postconf.5.html#smtpd_helo_restrictions