From b926af5fca03e936660c4b0128e4d111ef7133f4 Mon Sep 17 00:00:00 2001 From: Jens Ahrensfeld Date: Sun, 26 Jul 2026 09:31:10 +0200 Subject: [PATCH] Follow up on postfix-sasl and apache-noscript watch items Both were left as "revisit if it escalates" notes from earlier audits. Checked live logs on alpha via SSH (port 10022): postfix-sasl remains scattered low-volume noise, not a coordinated low-and-slow campaign like the dovecot spray; the original three /24s behind the apache-noscript distributed scan are no longer active, current activity is normal per-IP jail behavior. No fixes needed for either; also reconfirmed the dyndns per-user auth binding gap is still present and unfixed. Co-Authored-By: Claude Sonnet 5 --- README.md | 6 ++++++ TODO.md | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/README.md b/README.md index 79ed9ca..b6bbeb5 100644 --- a/README.md +++ b/README.md @@ -282,6 +282,12 @@ Audited 2026-07-20 — which public hostnames require credentials: design — it needs subnet-level (CIDR) banning instead, which risks blocking legitimate traffic sharing that block (e.g. carrier NAT). Left as routine scan noise for now; revisit if it escalates. + **Follow-up 2026-07-26**: rechecked — the original three `/24`s are gone + from current logs entirely (that specific campaign appears to have moved + on). `apache-noscript` shows normal jail activity (42 total bans, 3 + currently banned) from ordinary repeat-offender IPs already caught by + per-IP thresholds, not a new distributed single-shot pattern. No + escalation; still fine to leave as-is. - **No real nameserver redundancy**: 2026-07-19, `ns1.jayfield.org` and `ns2.jayfield.org` were registered as this domain's NS records at the diff --git a/TODO.md b/TODO.md index 9cca6e5..1d47057 100644 --- a/TODO.md +++ b/TODO.md @@ -280,6 +280,13 @@ Nothing here is urgent; all are low-risk, no-downtime changes. default thresholds and mail stack but showed much lower per-IP volume in this pass — worth a follow-up check if it starts trending the same way. + **Follow-up 2026-07-26**: checked `postfix-sasl` — still just scattered + background noise, not a coordinated campaign. Top offender + (`172.94.9.203`) logged 32 hits but all from late June/early July, none + since; current activity is single/double attempts from many different + IPs (no repeated per-IP low-and-slow pattern like the dovecot spray). + `findtime=30m`/`maxretry=3` defaults left as-is — no fix needed unless + this changes. Fixed: `/etc/fail2ban/jail.d/dovecot-findtime.local`, same values as the `sshd` fix (`findtime=1d`, `maxretry=4`, `bantime=1d`). Applied via `fail2ban-client reload dovecot`; verified live with