Blocking failed smtp relay requests

Are you using an RBL? I'd add that first. Also, limit relay to the local net, and use strong passwords, enabling mail only for users that need it.

The other thing I do, is enable the firewall. It has some built in rules which seem to help, but from memory can't recall if any are SMTP specific.

As for your original question. Yes, it is possible. I read a how to for this some time ago, but cannot locate at the moment, not even sure if it was a postfix config change or an ipfw rule.

Good to hear the basics are covered 🙂 You'd be surprised how often they're overlooked.

Looking up the actual error in your log, it looks to be warning indicating that the PTR doesn't have a corresponding A record. Basically, a fairly minor DNS issue on the sending MTA. So, might not be actual relay attempts. Relays should be dropped or show failed login attempts elsewise. /var/log/mail.log I think is where you'll see any failures.

What I was thinking of is the adaptive firewall. emond is meant to block IPs after 10 failed attempts, for 15 mins. I imagine it can be adapted, so to speak, to block the IPs for longer, or after fewer attempts. You could trawl through your logs to see if that's actually happening.

The command line tool for the adaptive firewall is afctl The rule that does the default blocking after 10 failed attempts is in a plist /etc/emond.d/rules/AdaptiveFirewall.plist

The postfix config can also be managed to block SMTP specific accesses, blacklisting or greylisting IPs. I'm trying to dig up details for how to do this in the way you'd like.

So, I think what might help in more general terms is fail2ban http://www.fail2ban.org/wiki/index.php/HOWTO_Mac_OS_X_Server_(10.5)

That how to is for 10.5, but should work for 10.6, too. Basically, it monitors logs and then uses the built in firewall to ban IPs. The advantage of this for your concern is that it will block all access from that IP. Including SSH and POP/IMAP.

You can also roll your own, basically by monitoring logs for failed logins (syslog command can pull out, or you can use grep), and then counting the number of failed logins for a particular IP over a set time, and adding that to a the postfix blacklist or firewall.