Postfix Relay Denied
Attack scenariosmtp:spamMITRE T1595MITRE T1190
- Version
- 0.1
- Name
- crowdsecurity/postfix-relay-denied
- Remediation
- Ban
Detect multiple open relay attempts
Install with a top-level collection
2 collections include itsudo cscli collections install crowdsecurity/apiscpInstalls 9 parsers and 56 scenarios, via Postfix - Bruteforce Protection.
View ApisCP →Installation
sudo cscli scenarios install crowdsecurity/postfix-relay-deniedThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
# postfix relay access deniedtype: leakyname: crowdsecurity/postfix-relay-denieddescription: "Detect multiple open relay attempts"filter: "evt.Meta.log_type == 'postfix' && evt.Meta.action == 'reject' && evt.Meta.reason == 'Relay access denied'"references:- https://en.wikipedia.org/wiki/Open_mail_relaygroupby: evt.Meta.source_ipcapacity: 1leakspeed: 600sblackhole: 1mreprocess: falselabels:service: postfixremediation: trueconfidence: 3spoofable: 0classification:- attack.T1595- attack.T1190behavior: "smtp:spam"label: "Postfix Relay Denied"
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
Postfix relay denied access
Postfix relay denied access is a log message generated when a client tries to relay an email through the server without being authorized to do so. This can happen for a variety of reasons, such as the client not being authenticated or the server not being configured to allow relaying from the client's IP address.
Many bots and spammers try to exploit open relays to send spam emails, so it's important to monitor for these types of events and take action to prevent unauthorized relaying.