Over the last year, the volume of garbage from Google cloud bad actors has become very noisy.
Here is a fail2ban filter that has been working well for me with postfix.
[INCLUDES]
before = common.conf
[Definition]
_daemon = postfix/(submission/)?(cleanup|smtp(d|s))
failregex = ^%(__prefix_line)s\S+: reject: .* from \S+\.bc\.googleusercontent\.com\[<HOST>\][;:]
^%(__prefix_line)simproper command pipelining after \S+ from \S+\.bc\.googleusercontent\.com\[<HOST>\]:?$
^%(__prefix_line)swarning: \S+\.bc\.googleusercontent\.com\[<HOST>\]: SASL \S+ authentication failed.*$
^%(__prefix_line)slost connection after \S+ from \S+\.bc\.googleusercontent\.com\[<HOST>\]$
ignoreregex =
[Init]
journalmatch = _SYSTEMD_UNIT=postfix.service
It’s been running for over a week and already minimizing the noise in the logs.
fail2ban-client status postfix-bc-googleuser
Status for the jail: postfix-bc-googleuser
|- Filter
| |- Currently failed: 0
| |- Total failed: 33
| `- File list: /var/log/mail.log
`- Actions
|- Currently banned: 30
|- Total banned: 30
`- Banned IP list: 35.239.201.206 162.216.149.213 34.86.203.200 34.62.76.198 34.78.174.118 35.252.82.232 34.182.252.213 35.237.229.129 34.106.161.16 35.231.143.0 34.86.37.186 35.227.123.136 34.121.3.15 34.76.88.115 35.195.127.65 34.85.165.5 34.73.34.221 35.197.81.125 34.186.61.249 162.216.150.10 34.38.249.142 35.205.114.184 35.240.22.53 34.156.176.105 34.156.55.75 35.240.24.252 34.156.194.74 35.203.174.10 34.133.211.239 136.70.68.24
