How to limit SMTP sending in a specific time

Support
1

NethServer Version: 7.9.2009

Module: Antivirus, Collectd Charts, Email, Fail2Ban, Report, Webserver, Webmail.

Hi everyone, is there a method that limit the SMTP mail sending in a specific time?

I would like to protect my NS against become a spammer, I need to find the way to send no more of 200 messages per hour.

Somebody can tell me how to get it?

Thanks in advance.

Nico

2

I recall a jail of fail2ban that can does it. It is enabled but I do not recall how many email per hour you can do it

3
4
5

The count is 33 x the maxtime per the findtime

So set the findtime to one hour and the maxretry to 6

If a user try to send more than the authorized quota then it is banned for a while. For what I recall the localhost is whitelisted

6

@davidep we should think to protect NS8 like we did for NS7

1 Like
7

I’m afraid we are off-topic with NS8 here.

I would like to protect my NS against become a spammer, I need to find the way to send no more of 200 messages per hour.

This seems to me a request for outbound messages rate limit. It is not about banning IPs for auth failures with Fail2Ban.

Maybe Postfix has a sending rate limit that can be set with a custom config?

1 Like
8

there is no errors, only a grep line that a user does when he sends an email

9

I’ll try to explain myself better, let’s say that my NS is hacked and the attacker uses it to shoot spam emails all over the internet. To limit the damage I would like to set a limit on hourly sending regardless of the IP from which it comes.

1 Like
10

I will try to check what postfix can do for you however with fail2ban, the hacker is completely ban from server, any ressources.

it does not take account about what is sent from a web application

11

In the meantime, I thank you.
fail2ban is very useful in case of attack attempts due to the blocking it applies, but it cannot do anything in case of theft of valid credentials.
For this reason I would like to limit the maximum number of messages that can be sent, for example, per hour

12

Hi @NicoB

Best would be to monitor the Mail-Queue.
Limiting without real reason can also limit legit info mailing to clients (example).

Wheras, when a spammer strikes, the mail queue is always filled up. If it’s full, and you are not aware of a reason, it’s spam and can be emptied (mailqueue) and repaired / excluded whatever. Often this comes from compromised or to easy access credentials.

Zabbix, on NS8, would be a nice option for this…

Postfix also has limiting options…
See here for some ideas:

My 2 cents
Andy

1 Like
13

Finally I’m come back,
thank you Andy!

I think that’s correct that you say, I’ll try to setup the first suggest and then will inform you about the results

Have a good evening

1 Like
14

And a warm welcome to you!