freebsd stable - Jul 2016 - Postfix and tcpwrappers?

On Jul 25, 2016, at 10:32 AM, Karl Denninger <karl at
denninger.net<mailto:karl at denninger.net>> wrote:

On 7/25/2016 12:04, Ronald Klop wrote:
On Mon, 25 Jul 2016 18:48:25 +0200, Karl Denninger
<karl at denninger.net<mailto:karl at denninger.net>> wrote:

This may not belong in "stable", but since Postfix is one of the
high-performance alternatives to sendmail....

Question is this -- I have sshguard protecting connections inbound, but
Postfix appears to be ignoring it, which implies that it is not paying
attention to the hosts.allow file (and the wrapper that enables it.)

Recently a large body of clowncars have been targeting my sasl-enabled
https gateway (which I use for client machines and thus do in fact need)
and while sshguard picks up the attacks and tries to ban them, postfix
is ignoring the entries it makes which implies it is not linked with the
tcp wrappers.

A quick look at the config for postfix doesn't disclose an obvious
configuration solution....did I miss it?


Don't know if postfix can handle tcp wrappers, but I use bruteblock
[1] for protecting connections via the ipfw firewall. I use this for
ssh and postfix.

I recompiled sshguard to use ipfw and stuck the table lookup in my
firewall config..... works, and is software-agnostic (thus doesn't care
if something was linked against tcpwrappers or not.)


I would triple concur with the above advice. using ipfw is a much better choice
(especially at high volume) as ipfw works primarily at layer 3 (and in the
kernel itself), Where as tcp wrappers works at layer 7 (requiring application
awareness).

Here are the handbook references:
https://www.freebsd.org/doc/handbook/tcpwrappers.html
https://www.freebsd.org/doc/handbook/firewalls-ipfw.html


--
Karl Denninger
karl at denninger.net<mailto:karl at denninger.net> <mailto:karl at
denninger.net>
/The Market Ticker/
/[S/MIME encrypted email preferred]/

On 07/25/2016 01:20 PM, Shawn Bakhtiar wrote:
> ecently a large body of clowncars have been targeting my sasl-enabled
> https gateway (which I use for client machines and thus do in fact need)
> and while sshguard picks up the attacks and tries to ban them, postfix
> is ignoring the entries it makes which implies it is not linked with the
> tcp wrappers.
> 
> A quick look at the config for postfix doesn't disclose an obvious
> configuration solution....did I miss it?
> 

You can more-or-less run anything from a wrapper if you don't daemonize it
and kick it off on-demand from inetd.  Essentially, you have inetd.conf
configured with a stanza that - upon connection attempt - launches an
instance of your desired program (postfix in this case), if and only
if the hosts.allow rules are satisfied.

This works nicely for smaller installations, but is very slow in high 
arrival rate environments because each connection attempt incurs the full
startup overhead of the program you're running.