38 lines
1.4 KiB
Markdown
38 lines
1.4 KiB
Markdown
# tricks
|
|
|
|
<!-- vim-markdown-toc GitLab -->
|
|
|
|
* [Logs](#logs)
|
|
* [get most active hosts](#get-most-active-hosts)
|
|
|
|
<!-- vim-markdown-toc -->
|
|
|
|
## Logs
|
|
|
|
### get most active hosts
|
|
|
|
Even if you use postmoogle as an internal mail server and contact "outside internet" quite rarely,
|
|
you will see lots of connections to your SMTP servers from random hosts over internet that do... nothing?
|
|
They don't send any valid emails or do something meaningful, thus you can safely assume they are spammers.
|
|
|
|
To get top X (in example: top 10) hosts with biggest count of attempts to connect to your postmoogle instance, run the following one-liner:
|
|
|
|
```bash
|
|
journalctl -o cat -u postmoogle | grep "accepted connection" | grep -oE "[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}:" | sort | uniq -ci | sort -rn | head -n 10
|
|
253 111.111.111.111
|
|
183 222.222.222.222
|
|
39 333.333.333.333
|
|
38 444.444.444.444
|
|
18 555.555.555.555
|
|
16 666.666.666.666
|
|
8 777.777.777.777
|
|
5 888.888.888.888
|
|
5 999.999.999.999
|
|
4 010.010.010.010
|
|
```
|
|
|
|
of course, IP addresses above are crafted just to visualize their place in that top, according to the number of connections done.
|
|
In reality, you will see real IP addresses here. Usually, only hosts with hundreds or thousands of connections for the last 7 days worth checking.
|
|
|
|
What's next?
|
|
Do **not** ban them right away. Check WHOIS info for each host and only after that decide if you really want to ban that host or not.
|