Question SMTP Firewall - is it possible to block brutforce attacks?

[wakabayashi]

Server operating system version

Debian 12.8

Plesk version and microupdate number

Plesk Obsidian v18.0.65_build1800241122.08 os_Debian 12.0

Hello

In my logs a see random trials to connect to my mail server. Entries like this

Dec 16 11:24:49 my.pleskdomain.com postfix/smtpd[276348]: warning: unknown[185.196.10.158]: SASL LOGIN authentication failed: authentication failure, sasl_username=center

While I am using Fail2Ban. It's still very annoying to see such attacks over and over again. I thought, that I could geoblock it with the SMTP Firewall Settings.


I set this to "Allow from selected sources, deny from others" and only allowed a certain country. But somehow this seems to block also incoming emails. Other Servers can't send emails. What is the problem? Is it even possible to block one of these SMTP Firewall Setting?

 

[Vladimir C.]

Hello! Please ensure fail2ban jails are active for mail services (Postfix/Dovecot). Also, it is possible that time interval for detection of subsequent attacks is not enough to stop this breach attempts. Go to Tools & Settings > IP Address Banning (Fail2Ban) > Time interval for detection of subsequent attacks and increase this value. Please let me know if it does not help!

 

[wakabayashi]

Thanks a lot for your answer! Yeah, this is what I am trying to do. I have opened another thread for that. Likely my "Time interval for detection of subsequent attacks" was too low.

But can you answer my question in general: Should both SMTP settings be open for all IPs? It really seems to me, that other servers can't send a mail on my server if I restrict this. Even if this is the setting for my server to send emails (465 port).

 

[Vladimir C.]

Generally if you disable SMTP (Mail sending) in Plesk firewall which is in fact port 25 then other mail servers will not be able to deliver emails to your server. Other mail servers do not use port 465 for delivery. They strictly adhere to port 25 for SMTP communication.

The general recommendation is:

1. Keep port 25 open for incoming mail (required for other servers to send mail to you).
2. Disable port 587 only if you sure all mail clients will use port 465.
3. Port 465 alone is fine for secure email submission (outgoing), but it cannot replace port 25 for incoming email delivery.