fail2ban: SASL LOGIN authentication failed:

[t0mmy]

beim prüfen der logs ist mir das in dem mail.log aufgefallen:

May 15 12:40:27 srv postfix/smtpd[2245255]: connect from unknown[80.94.95.242]
May 15 12:40:33 srv postfix/smtpd[2245255]: warning: unknown[80.94.95.242]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 15 12:40:33 srv postfix/smtpd[2245255]: disconnect from unknown[80.94.95.242] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
May 15 12:40:46 srv postfix/smtpd[2244541]: connect from unknown[80.94.95.242]
May 15 12:40:52 srv postfix/smtpd[2244541]: warning: unknown[80.94.95.242]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 15 12:40:52 srv postfix/smtpd[2244541]: disconnect from unknown[80.94.95.242] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
May 15 12:41:06 srv postfix/smtpd[2245255]: connect from unknown[80.94.95.242]
May 15 12:41:13 srv postfix/smtpd[2245255]: warning: unknown[80.94.95.242]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 15 12:41:13 srv postfix/smtpd[2245255]: disconnect from unknown[80.94.95.242] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
May 15 12:41:26 srv postfix/smtpd[2244541]: connect from unknown[80.94.95.242]
May 15 12:41:33 srv postfix/smtpd[2244541]: warning: unknown[80.94.95.242]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 15 12:41:33 srv postfix/smtpd[2244541]: disconnect from unknown[80.94.95.242] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4

das geht den ganzen tag so... man könnte denken fail2ban spinnt, ich habe realtiv lange gebraucht um zu finden das diese Attacke nicht vom [postfix-sasl] jail behandelt wird, es muss der [postfix] jail sein und zwar klappt es folgendes zur jail.local config hinzuzufügen:

[postfix]
mode = aggressive
enabled = true
logpath = /var/log/mail.log
maxretry = 3
bantime = 999999

bantime kann man anpassen, ich banne direkt für ~11 Tage (999999 Sekunden)