[SOLVED] Banned IP information

[Chriswiss]

Hello,

Is it possible to have a function that informs the administrator if an email is "bounced" due to banned IP?

An example to better understand the demand.

status=bounced (host positivecoating-ch.mail.protection.outlook.com[104.47.1.36] said: 550 5.7.606 Access denied, banned sending IP [AAA.BBB.CCC.DDD]. To request removal from this list please visit https://sender.office.com/ and follow the directions. For more information please go to http://go.microsoft.com/fwlink/?LinkID=526655 (AS16012609) (in reply to RCPT TO command))

If such a message passes from the Syslog/Tracking center have a return by email.
So it allows the admin to do the necessary things.

Thank you very much.
Grüße

 

[Stoiko Ivanov]

Hi,
Those bounce messages do not have a particular format and contain free text, thus making it difficult to get only the desired ones.

You can configure postfix to drop you(postmaster for the domain) a mail for each bounced mail - but this usually contains far too many mails to be an actual help - see http://www.postfix.org/postconf.5.html#notify_classes for details.

Alternatively you can take a look at fail2ban - which is AFAIR a rather nice and generic framework, parsing logs and setting actions (usually blocking via firewall, but you could probably use it as well to send you an email when a logline matches a regular expression)

Hope this helps!

 

[Chriswiss]

Hello,

That's right, yes! I hadn't thought about using Fail2ban !
Thank you so much.

CG

 

[dthompson]

Do you have an example on how to integrate fail2ban with pmg? I think this is something I'd like to look at to help block some brute force attacks.

 

[Chriswiss]

Do you have an example on how to integrate fail2ban with pmg? I think this is something I'd like to look at to help block some brute force attacks.

Hello,

You can already adapt the PVE explanations for PMG as a first step.
https://pve.proxmox.com/wiki/Fail2ban

Greetings

 

[heutger]

Here is also a tutorial directly for PMG: https://forum.proxmox.com/threads/install-fail2ban.50049/#post-240831