サーバーセキュリティ (Fail2ban)

sudo apt update
sudo apt install -y fail2ban

etc/
└─ fail2ban/
    ├── action.d/
    ├── fail2ban.d/
    ├── filter.d/ ← ※検知用のファイルが保存されています
    ├── jail.d/
    ├── fail2ban.conf
    ├── jail.conf
    ├── jail.local ← ※新たにファイルを作成します
    ├── paths-arch.conf
    ├── paths-common.conf
    ├── paths-debian.conf
    └── paths-opensuse.conf

[Definition]
failregex = ^<HOST> - - \[.*\] "(GET|POST) (?:/[^"]*)?wp-login\.php(?:\?.*)? HTTP/[^"]+" 403 .*
ignoreregex =

[DEFAULT]
backend  = auto
maxretry = 3
findtime = 10m
bantime  = 1h
bantime.increment = true
bantime.factor    = 2
bantime.maxtime   = 7d
banaction         = nftables

ignoreip = 127.0.0.1/8 ::1

[sshd]
enabled = true
backend = systemd

[apache-botsearch]
enabled  = true
port     = http,https
filter   = apache-botsearch
logpath  = /var/log/apache2/access.log
maxretry = 5
findtime = 5m
bantime  = 24h

[DEFAULT]
backend  = auto
maxretry = 3
findtime = 10m
bantime  = 1h
bantime.increment = true
bantime.factor    = 2
bantime.maxtime   = 7d
banaction         = nftables

# ローカルや管理用 IP を誤って Ban しないよう除外する
# 複数指定する場合はスペース区切り
ignoreip = 127.0.0.1/8 ::1

[sshd]
enabled = true
backend = systemd

sudo fail2ban-client -t

user01@DESKTOP-CQEA49P:~$ sudo fail2ban-client -t
2026-02-20 11:46:41,130 fail2ban                [2862]: ERROR   Failed during configuration: File contains no section headers.
file: '/etc/fail2ban/jail.local', line: 1
'\ufeff[DEFAULT]\n'
2026-02-20 11:46:41,130 fail2ban                [2862]: ERROR   ERROR: test configuration failed

sudo tee /etc/fail2ban/jail.local > /dev/null << 'EOF'
[DEFAULT]
backend  = auto
maxretry = 3
findtime = 10m
bantime  = 1h
bantime.increment = true
bantime.factor    = 2
bantime.maxtime   = 7d
banaction         = nftables

ignoreip = 127.0.0.1/8 ::1

[sshd]
enabled = true
backend = systemd
EOF

sudo systemctl restart fail2ban

user01@DESKTOP-CQEA49P:~$ sudo fail2ban-client status
Status
|- Number of jail:      1
`- Jail list:   sshd
user01@DESKTOP-CQEA49P:~$

xxx.xxx.xxx.xxx - - [01/Feb/2026:13:53:55 +0900] "GET /wp-login.php HTTP/1.1" 302 3419 "https://twitter.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36"
xxx.xxx.xxx.xxx - - [01/Feb/2026:13:53:56 +0900] "GET /blog/wp-login.php HTTP/1.1" 403 486 "https://twitter.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36"
xxx.xxx.xxx.xxx - - [01/Feb/2026:13:54:29 +0900] "POST /wp-login.php HTTP/1.1" 302 920 "https://mimura-soft.jp/wp-login.php" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36"
xxx.xxx.xxx.xxx - - [01/Feb/2026:13:54:30 +0900] "GET /blog/wp-login.php HTTP/1.1" 403 486 "https://mimura-soft.jp/wp-login.php" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36"
xxx.xxx.xxx.xxx - - [01/Feb/2026:13:54:30 +0900] "POST /wp-login.php HTTP/1.1" 302 920 "https://mimura-soft.jp/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.2210.133"
xxx.xxx.xxx.xxx - - [01/Feb/2026:13:54:30 +0900] "GET /blog/wp-login.php HTTP/1.1" 403 486 "https://mimura-soft.jp/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.2210.133"
xxx.xxx.xxx.xxx - - [01/Feb/2026:13:54:30 +0900] "POST /wp-login.php HTTP/1.1" 302 920 "https://mimura-soft.jp/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36"
xxx.xxx.xxx.xxx - - [01/Feb/2026:13:54:31 +0900] "GET /blog/wp-login.php HTTP/1.1" 403 486 "https://mimura-soft.jp/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36"
xxx.xxx.xxx.xxx - - [01/Feb/2026:13:54:31 +0900] "POST /wp-login.php HTTP/1.1" 302 920 "https://mimura-soft.jp/wp-login.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.130 Safari/537.36"
...

[Definition]
failregex = ^<HOST> - - \[.*\] "(GET|POST) (?:/[^"]*)?wp-login\.php(?:\?.*)? HTTP/[^"]+" 403 .*
ignoreregex =

[wordpress-auth]
enabled  = true
port     = http,https
filter   = wordpress-auth
logpath  = /var/log/apache2/access.log
maxretry = 3
findtime = 10m
bantime  = 24h

sudo fail2ban-regex /var/log/apache2/access.log /etc/fail2ban/filter.d/wordpress-auth.conf

user01@DESKTOP-CQEA49P:~$ sudo fail2ban-regex /var/log/apache2/access.log /etc/fail2ban/filter.d/wordpress-auth.conf

Running tests
=============

Use   failregex filter file : wordpress-auth, basedir: /etc/fail2ban
Use         log file : /var/log/apache2/access.log
Use         encoding : UTF-8


Results
=======

Failregex: 155 total
|-  #) [# of hits] regular expression
|   1) [155] ^<HOST> - - \[.*\] "(GET|POST) (?:/[^"]*)?wp-login\.php(?:\?.*)? HTTP/[^"]+" 403 .*
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [6295] Day(?P<_sep>[-/])MON(?P=_sep)ExYear[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
`-

Lines: 6295 lines, 0 ignored, 155 matched, 6140 missed
[processed in 0.36 sec]

Missed line(s): too many to print.  Use --print-all-missed to print all 6140 lines
user01@DESKTOP-CQEA49P:~$

sudo systemctl restart fail2ban

user01@DESKTOP-CQEA49P:~$ sudo fail2ban-client status wordpress-auth
Status for the jail: wordpress-auth
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- File list:        /var/log/apache2/access.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list:   xxx.xxx.xxx.xxx
user01@DESKTOP-CQEA49P:~$

user01@DESKTOP-CQEA49P:~$ sudo nft list table inet f2b-table
table inet f2b-table {
        set addr-set-wordpress-auth {
                type ipv4_addr
                elements = { xxx.xxx.xxx.xxx }
        }

        chain f2b-chain {
                type filter hook input priority filter - 1; policy accept;
                tcp dport { 80, 443 } ip saddr @addr-set-wordpress-auth reject with icmp port-unreachable
        }
}
user01@DESKTOP-CQEA49P:~$

# 手動 Ban
sudo fail2ban-client set wordpress-auth banip xxx.xxx.xxx.xxx

# 解除
sudo fail2ban-client set wordpress-auth unbanip xxx.xxx.xxx.xxx

xxx.xxx.xxx.xxx - - [01/Feb/2026:13:54:30 +0900] "GET /blog/wp-login.php HTTP/1.1" 403 486 "https://mimura-soft.jp/wp-login.php" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36"

<FilesMatch "^(wp-config\.php|wp-cron\.php|xmlrpc\.php|wp-login\.php)">
  order deny,allow
  deny from all
  allow from 127.0.0.1
  allow from xxx.xxx.xxx.xxx
</FilesMatch>

<wordpress>/
└─ wp-content/
    └─ plugins/
        └─ my-fail2ban/
            └─ my-fail2ban.php

<?php
/*
Plugin Name: My Fail2ban
Author: <your name>
Description: Log WordPress login failures to syslog for fail2ban
Version: 1.0
*/
add_action('wp_login_failed', function ($username) {
    $ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
    $ua = $_SERVER['HTTP_USER_AGENT'] ?? 'unknown';
    error_log("WP-LOGIN-FAIL user={$username} ip={$ip} ua={$ua}");
});

sudo chown -R www-data:www-data ./my-fail2ban

[Mon Feb 23 10:49:04.192500 2026] [php:notice] [pid 425] [client 172.29.112.1:51660] WP-LOGIN-FAIL user=@yuuji_mimura ip=172.29.112.1 ua=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36, referer: http://mimura-soft.jp/blog/wp-login.php?loggedout=true&wp_lang=ja

[Definition]
failregex = WP-LOGIN-FAIL user=.* ip=<HOST> .*
ignoreregex =

[wordpress-auth-hook]
enabled  = true
port     = http,https
filter   = wordpress-auth-hook
logpath  = /var/log/apache2/error.log
maxretry = 3
findtime = 10m
bantime  = 24h

sudo fail2ban-client -t
sudo fail2ban-regex /var/log/apache2/error.log /etc/fail2ban/filter.d/wordpress-auth-hook.conf

sudo systemctl restart fail2ban

2026-02-23 11:08:21,934 fail2ban.filter         [2919]: INFO    [wordpress-auth-hook] Found 172.29.112.1 - 2026-02-23 11:08:21

xxx.xxx.xxx.xxx - - [08/Feb/2026:09:46:43 +0900] "GET / HTTP/1.1" 200 73639 "-" "Mozilla/5.0"
xxx.xxx.xxx.xxx - - [08/Feb/2026:09:46:44 +0900] "GET /.env HTTP/1.1" 301 3278 "-" "Mozilla/5.0"
xxx.xxx.xxx.xxx - - [08/Feb/2026:09:46:45 +0900] "GET /.env.local HTTP/1.1" 301 3284 "-" "Mozilla/5.0"
xxx.xxx.xxx.xxx - - [08/Feb/2026:09:46:46 +0900] "GET /.env.production HTTP/1.1" 301 3288 "-" "Mozilla/5.0"
xxx.xxx.xxx.xxx - - [08/Feb/2026:09:46:47 +0900] "GET /.env.development HTTP/1.1" 301 3291 "-" "Mozilla/5.0"
xxx.xxx.xxx.xxx - - [08/Feb/2026:09:46:48 +0900] "GET /.env.dev HTTP/1.1" 301 3283 "-" "Mozilla/5.0"
xxx.xxx.xxx.xxx - - [08/Feb/2026:09:46:48 +0900] "GET /.env.prod HTTP/1.1" 301 3282 "-" "Mozilla/5.0"
...

# Block common secret files / bot scans early

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Allow .well-known (Let's Encrypt etc.)
  RewriteRule "^/\.well-known(/.*)?$" "-" [L]

  # Block Vite/Dev Server abuse
  RewriteRule "^/@fs(/|$)" "-" [F,L,NC]

  # Block environ leak path
  RewriteRule "proc/self/environ" "-" [F,L,NC]

  # Block dotfiles and dot directories anywhere (/.env, /.git, /.aws, /.streamlit, etc.)
  RewriteRule "(^|/)\." "-" [F,L]

  # Block non-dot secret/config filenames often leaked accidentally
  RewriteRule "(?i)(^|/)(docker-compose(\..*)?\.ya?ml|serverless\.ya?ml|secrets(\..*)?\.(json|ya?ml|toml)|credentials\.json|appsettings(\..*)?\.json|application(-.*)?\.(properties|ya?ml)|wp-config\.php(\..*)?)$" "-" [F,L]

  # Block traversal-like encoded patterns
  RewriteCond %{THE_REQUEST} "(?i)(\.\./|%2e%2e%2f|%2f\.\.|%252f)" [OR]
  RewriteCond %{REQUEST_URI}  "(?i)(\.\./|%2e%2e%2f|%2f\.\.|%252f)"
  RewriteRule ".*" "-" [F,L]
</IfModule>

sudo a2enmod rewrite

sudo a2enconf hardening-scans
sudo apachectl configtest
sudo systemctl reload apache2

curl -i http://<ホスト名>/.env
curl -i http://<ホスト名>/@fs/
curl -i http://<ホスト名>/proc/self/environ
curl -i "http://<ホスト名>/%2e%2e%2f"

# Block common secret files / bot scans early

# URLとして来る攻撃パスをブロック (静的 / WordPress / リバースプロキシ 全部に対応)
<LocationMatch "(?i)^/(?:@fs(?:/|$)|@vite(?:/|$)|vite-client$|proc/self/environ$)">
  Require all denied
</LocationMatch>

# パストラバーサルをブロック
<LocationMatch "(?i)(?:\.\./|%2e%2e%2f|%2f\.\.|%252f)">
  Require all denied
</LocationMatch>

#ファイル実体の漏えいをブロック (/var/www/html 配下のサブフォルダ内のファイルにも有効)
<Directory /var/www/html>
  # dotfiles: .env, .git, .aws, ...
  <FilesMatch "(?i)^\.(?!well-known$).+">
    Require all denied
  </FilesMatch>

  # 狙われやすい設定ファイルへのアクセスをブロック
  <FilesMatch "(?i)^(wp-config\.php(?:\..*)?|docker-compose(\..*)?\.ya?ml|compose\.ya?ml|serverless\.ya?ml|credentials\.json|appsettings(\..*)?\.json|application(-.*)?\.(properties|ya?ml|yaml)|secrets(\..*)?\.(json|ya?ml|yaml|toml))$">
    Require all denied
  </FilesMatch>
</Directory>

# Let's Encrypt などを使用している場合は .well-known を許可
<Directory "/var/www/html/.well-known">
  Require all granted
</Directory>

[Definition]
allowipv6 = auto
failregex = ^<HOST> .* "(GET|POST|HEAD) (?:https?://[^ ]+)?/(?:@fs(?:/|$)|.*proc/self/environ|.*\.env(?:[^ ]*)?|.*\.git|.*\.aws|.*\.streamlit|docker-compose(?:\..*)?\.ya?ml).*" (?:400|403|404) .*$
ignoreregex =

[apache-envscan]
enabled  = true
port     = http,https
filter   = apache-envscan
logpath  = /var/log/apache2/access.log
maxretry = 1
findtime = 24h
bantime  = 7d
bantime.increment = true
bantime.factor = 2
bantime.maxtime = 30d

2026-02-08T00:00:12.443401+09:00 mimura-soft postfix/smtpd[17033]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=thunder@mimura-soft.jp
2026-02-08T00:00:13.594634+09:00 mimura-soft postfix/smtpd[17033]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
2026-02-08T00:00:29.857238+09:00 mimura-soft postfix/smtpd[17033]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-08T00:00:36.498676+09:00 mimura-soft postfix/smtpd[17033]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=tiger@mimura-soft.jp
2026-02-08T00:00:37.556327+09:00 mimura-soft postfix/smtpd[17033]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
2026-02-08T00:00:55.107838+09:00 mimura-soft postfix/smtpd[17237]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-08T00:01:01.121826+09:00 mimura-soft postfix/smtpd[17237]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=tmbecker@mimura-soft.jp
2026-02-08T00:01:01.814733+09:00 mimura-soft postfix/smtpd[17237]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
2026-02-08T00:01:20.852168+09:00 mimura-soft postfix/smtpd[17033]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-08T00:01:26.264459+09:00 mimura-soft postfix/smtpd[17033]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=tmp@mimura-soft.jp
2026-02-08T00:01:27.561799+09:00 mimura-soft postfix/smtpd[17033]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
2026-02-08T00:01:46.084281+09:00 mimura-soft postfix/smtpd[17237]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-08T00:01:52.016981+09:00 mimura-soft postfix/smtpd[17237]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=tomcat4@mimura-soft.jp
2026-02-08T00:01:52.305199+09:00 mimura-soft postfix/smtpd[17237]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
...

[postfix]
enabled  = true
port     = smtp,submission,smtps
filter   = postfix
logpath  = /var/log/mail.log
maxretry = 2
findtime = 1h
bantime  = 24h

[Definition]
failregex = ^.*warning: .*\[<HOST>\]: SASL (?:LOGIN|PLAIN) authentication failed:.*$
ignoreregex =

[postfix-sasl]
enabled  = true
filter   = postfix-sasl
logpath  = /var/log/mail.log
maxretry = 2
findtime = 1h
bantime  = 24h

2026-02-08T11:27:52.614220+09:00 mimura-soft postfix/submission/smtpd[21771]: improper command pipelining after CONNECT from xxxx [xxx.xxx.xxx.xxx]: \026\003\001\000{\001\000\000w\003\003\344\027\261o\204ca\222~\353\306\026p\207\374H>N\361\032\330\226mAa&\301\366\2411\365r\000\000\032\300/\300+\300\021\300\a\300\023\300\t\300\024\300\n\000\005\000/\0005\300\022\000\n\001\000\0004\000\005\000\005\001\000\000\000\000\000\n\000\b\000\006\000\027\000\030\000\031\000\v\000
2026-02-08T11:27:52.614557+09:00 mimura-soft postfix/submission/smtpd[21771]: warning: non-SMTP command from xxxx [xxx.xxx.xxx.xxx]: \001\000\0004\000\005\000\005\001\000\000\000\000\000

[Definition]
failregex =
    ^.* postfix/(?:submission/)?smtpd\[\d+\]: warning: non-SMTP command from \S*\[<HOST>\].*$
    ^.* postfix/(?:submission/)?smtpd\[\d+\]: improper command pipelining after CONNECT from \S*\[<HOST>\]:.*$
ignoreregex =

[postfix-protocol]
enabled  = true
port     = smtp,submission,smtps
filter   = postfix-protocol
logpath  = /var/log/mail.log
maxretry = 3
findtime = 1h
bantime  = 24h

[recidive]
enabled  = true
logpath  = /var/log/fail2ban.log
maxretry = 2
findtime = 1d
bantime  = 30d

sudo fail2ban-client reload

ufw --version

sudo apt update
sudo apt install ufw

sudo ufw default deny incoming
sudo ufw default allow outgoing

# Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback
# accepted). You will need to 'disable' and then 'enable' the firewall for
# the changes to take affect.
IPV6=no

# すべてのアドレスに公開する場合
sudo ufw allow 22/tcp

# アクセスできる IP アドレスを指定する場合
sudo ufw allow from xxx.xxx.xxx.xxx to any port 22 proto tcp

# アクセスできる IP アドレスの範囲を指定する場合
sudo ufw allow from xxx.xxx.xxx.xxx/24 to any port 22 proto tcp

# Web サーバー
sudo ufw allow 80/tcp   # 必要に応じて
sudo ufw allow 443/tcp

# メールサーバー
sudo ufw allow 25/tcp   # smtp       (MTA 受信用)
sudo ufw allow 465/tcp  # smtps      (送信用)
sudo ufw allow 587/tcp  # submission (送信用)
sudo ufw allow 993/tcp  # imaps      (受信用)
# など必要に応じて

sudo ufw enable

sudo ufw disable

sudo ufw status

# 番号付きで見たい場合は以下のように入力します
sudo ufw status numbered

# 先頭に追加したい場合
sudo ufw insert 1 allow 80/tcp

sudo ufw delete <ルール番号>

root@mimura-soft:/# ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 25/tcp                     ALLOW IN    Anywhere
[ 2] 443/tcp                    ALLOW IN    Anywhere
[ 3] 22/tcp                     ALLOW IN    xxx.xxx.xxx.xxx
[ 4] 465/tcp                    ALLOW IN    xxx.xxx.xxx.xxx
[ 5] 993/tcp                    ALLOW IN    xxx.xxx.xxx.xxx

root@mimura-soft:/#

user01@DESKTOP-CQEA49P:~$ telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 mail.mimura-soft.jp ESMTP
EHLO test
250-mail.mimura-soft.jp
250-PIPELINING
250-SIZE 10240000
250-ETRN
250-AUTH PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250-SMTPUTF8
250 CHUNKING
QUIT
221 2.0.0 Bye
Connection closed by foreign host.
user01@DESKTOP-CQEA49P:~$

2026-02-23T05:56:21.419105+09:00 mimura-soft postfix/smtpd[61963]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-23T05:56:24.389950+09:00 mimura-soft postfix/smtpd[61963]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
2026-02-23T05:56:51.159511+09:00 mimura-soft postfix/smtpd[61963]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-23T05:56:53.785480+09:00 mimura-soft postfix/smtpd[61963]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
2026-02-23T05:57:17.946607+09:00 mimura-soft postfix/smtpd[61963]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-23T05:57:20.962418+09:00 mimura-soft postfix/smtpd[61963]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
2026-02-23T05:57:44.731129+09:00 mimura-soft postfix/smtpd[61963]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-23T05:57:48.503407+09:00 mimura-soft postfix/smtpd[61963]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
2026-02-23T05:58:12.698825+09:00 mimura-soft postfix/smtpd[61963]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-23T05:58:15.407663+09:00 mimura-soft postfix/smtpd[61963]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
2026-02-23T05:58:39.791862+09:00 mimura-soft postfix/smtpd[61963]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-23T05:58:42.506298+09:00 mimura-soft postfix/smtpd[61963]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
...

smtpd_recipient_restrictions = 
  permit_mynetworks,
  permit_sasl_authenticated,
  reject_unauth_destination

220 mail.mimura-soft.jp ESMTP
EHLO test
250-mail.mimura-soft.jp
250-PIPELINING
250-SIZE 10240000
250-ETRN
250-AUTH PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250-SMTPUTF8
250 CHUNKING
MAIL FROM:<test@example.com>
250 2.1.0 Ok
RCPT TO:<someone@gmail.com>
454 4.7.1 <someone@gmail.com>: Relay access denied

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (no)    (never) (100)
# ==========================================================================
smtp      inet  n       -       y       -       -       smtpd
  -o smtpd_sasl_auth_enable=no
#smtp      inet  n       -       y       -       1       postscreen
#smtpd     pass  -       -       y       -       -       smtpd
#dnsblog   unix  -       -       y       -       0       dnsblog
#tlsproxy  unix  -       -       y       -       0       tlsproxy

sudo postfix reload

user01@DESKTOP-CQEA49P:~$ telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 mail.mimura-soft.jp ESMTP
EHLO test
250-mail.mimura-soft.jp
250-PIPELINING
250-SIZE 10240000
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250-SMTPUTF8
250 CHUNKING
QUIT
221 2.0.0 Bye
Connection closed by foreign host.
user01@DESKTOP-CQEA49P:~$

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (no)    (never) (100)
# ==========================================================================
#smtp      inet  n       -       y       -       -       smtpd
#  -o smtpd_sasl_auth_enable=no
smtp      inet  n       -       y       -       1       postscreen
smtpd     pass  -       -       y       -       -       smtpd
  -o smtpd_sasl_auth_enable=no
dnsblog   unix  -       -       y       -       0       dnsblog
tlsproxy  unix  -       -       y       -       0       tlsproxy

# --- postscreen hardening (safe baseline) ---
postscreen_greet_action = enforce
postscreen_greet_wait = 6s

postscreen_pipelining_action = enforce
postscreen_non_smtp_command_action = enforce
postscreen_bare_newline_action = enforce

postscreen_cache_map = btree:/var/lib/postfix/postscreen_cache
postscreen_cache_retention_time = 7d

# --- DNSBL (optional but very effective) ---
postscreen_dnsbl_action = enforce
postscreen_dnsbl_sites =
    zen.spamhaus.org=127.0.0.[2..11]*3
    bl.spamcop.net=127.0.0.2*2
postscreen_dnsbl_threshold = 3

# 更新
sudo postfix reload

# 再起動
sudo systemctl restart postfix

2026-02-23T16:55:31.708828+09:00 mimura-soft postfix/postscreen[68523]: CONNECT from [xxx.xxx.xxx.xxx]:36690 to [153.126.131.65]:25
2026-02-23T16:55:31.999334+09:00 mimura-soft postfix/postscreen[68523]: PREGREET 11 after 0.29 from [xxx.xxx.xxx.xxx]:36690: EHLO User\r\n
2026-02-23T16:55:32.041153+09:00 mimura-soft postfix/smtpd[68524]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-23T16:55:32.335457+09:00 mimura-soft postfix/smtpd[68524]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 quit=1 commands=2
2026-02-23T16:55:58.639234+09:00 mimura-soft postfix/postscreen[68523]: CONNECT from [xxx.xxx.xxx.xxx]:44170 to [153.126.131.65]:25
2026-02-23T16:55:58.928043+09:00 mimura-soft postfix/postscreen[68523]: PREGREET 11 after 0.29 from [xxx.xxx.xxx.xxx]:44170: EHLO User\r\n
2026-02-23T16:55:58.929398+09:00 mimura-soft postfix/smtpd[68524]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-23T16:55:59.326516+09:00 mimura-soft postfix/smtpd[68524]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 quit=1 commands=2
2026-02-23T16:56:25.059487+09:00 mimura-soft postfix/postscreen[68523]: CONNECT from [xxx.xxx.xxx.xxx]:51454 to [153.126.131.65]:25
2026-02-23T16:56:25.349104+09:00 mimura-soft postfix/postscreen[68523]: PREGREET 11 after 0.29 from [xxx.xxx.xxx.xxx]:51454: EHLO User\r\n
2026-02-23T16:56:25.350193+09:00 mimura-soft postfix/smtpd[68524]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-23T16:56:25.789270+09:00 mimura-soft postfix/smtpd[68524]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 quit=1 commands=2
2026-02-23T16:56:52.042468+09:00 mimura-soft postfix/postscreen[68523]: CONNECT from [xxx.xxx.xxx.xxx]:58582 to [153.126.131.65]:25
2026-02-23T16:56:52.332820+09:00 mimura-soft postfix/postscreen[68523]: PREGREET 11 after 0.29 from [xxx.xxx.xxx.xxx]:58582: EHLO User\r\n
2026-02-23T16:56:52.333892+09:00 mimura-soft postfix/smtpd[68524]: connect from unknown[xxx.xxx.xxx.xxx]
2026-02-23T16:56:52.750680+09:00 mimura-soft postfix/smtpd[68524]: disconnect from unknown[xxx.xxx.xxx.xxx] ehlo=1 quit=1 commands=2
2026-02-23T16:57:19.065611+09:00 mimura-soft postfix/postscreen[68523]: CONNECT from [xxx.xxx.xxx.xxx]:37512 to [153.126.131.65]:25
2026-02-23T16:57:19.757749+09:00 mimura-soft postfix/postscreen[68523]: PREGREET 11 after 0.69 from [xxx.xxx.xxx.xxx]:37512: EHLO User\r\n
...

[Definition]
failregex =
            ^.*\spostfix/postscreen\[\d+\]:\s+PREGREET\s+\d+\s+after\s+[0-9.]+\s+from\s+\[<HOST>\](?::\d+)?:
            ^.*\spostfix/postscreen\[\d+\]:\s+HANGUP\s+after\s+\d+\s+from\s+\[<HOST>\](?::\d+)?
            ^.*\spostfix/postscreen\[\d+\]:\s+DNSBL\s+rank\s+\d+\s+for\s+\[<HOST>\]:
            ^.*\spostfix/postscreen\[\d+\]:\s+(?:NON-SMTP command|BARE NEWLINE|COMMAND PIPELINING)\s+from\s+\[<HOST>\](?::\d+)?
ignoreregex =

[postfix-postscreen]
enabled  = true
port     = smtp
filter   = postfix-postscreen
logpath  = /var/log/mail.log
maxretry = 2
findtime = 2h
bantime  = 24h

sudo fail2ban-client reload