feat: add Postfix slow brute-force and HELO rejection scenarios by Etilem · Pull Request #1695 · crowdsecurity/hub

Etilem · 2026-02-21T08:50:51Z

Summary

Add slow brute-force detection scenarios for Postfix SMTP authentication (port 25 and port 587) and evasive HELO rejection attacks.
Extends the existing crowdsecurity/postfix-logs parser for submission port auth failures that are invisible to standard parsers.

Developed and tested on a production mail server handling 17 domains, where these scenarios detected persistent evasive attacks that standard Postfix scenarios missed entirely.

Problem

Standard CrowdSec Postfix detection has two major gaps:

Slow SASL brute-force on port 25: crowdsecurity/postfix-bf has a short detection window. Attackers spacing attempts 15+ minutes apart evade it completely.
Port 587 (submission) auth failures are invisible: When using STARTTLS on port 587, Postfix does NOT log explicit "SASL authentication failed" messages. Auth failures only appear as auth=0/N in disconnect summary lines — no standard parser extracts this information.
Slow HELO rejection attacks: crowdsecurity/postfix-helo-rejected has a ~10 minute window. Evasive spammers sending invalid HELO commands ~70 minutes apart go undetected.

Scenarios

Scenario	Leakspeed	Capacity	Window	Use Case
`melite/postfix-slow-bf`	900s	7	2h	Distributed SASL attacks (port 25)
`melite/postfix-very-slow-bf`	4h	5	24h	Evasive SASL attacks (port 25)
`melite/postfix-submission-very-slow-bf`	4h	5	24h	Evasive attacks on port 587
`melite/postfix-helo-very-slow`	4h	5	24h	Evasive invalid HELO spammers

The first two scenarios include _user-enum variants (using distinct on sasl_username).

Parser change

crowdsecurity/postfix-logs (s01-parse): Extended with a new grok pattern that extracts auth=0/N from Postfix disconnect lines. Tags matching lines with log_type_enh: submission-auth-failed.

Example log that was previously invisible:
postfix/submission/smtpd[1234]: disconnect from unknown[IP] ehlo=1 auth=0/1 quit=1 commands=2/3

Note: Following reviewer feedback, this extends the existing crowdsecurity/postfix-logs parser instead of adding a separate parser.

Testing

cscli hubtest run postfix-slow-bf --save-results
cscli hubtest run postfix-very-slow-bf --save-results
cscli hubtest run postfix-submission-very-slow-bf --save-results
cscli hubtest run postfix-helo-very-slow --save-results
cscli hubtest run postfix-submission-auth --save-results

Dependencies

- crowdsecurity/syslog-logs
- crowdsecurity/postfix-logs
- crowdsecurity/dateparse-enrich

sabban · 2026-03-02T08:24:47Z

Hi,
Your PR redefines a postfix parser that can parse slightly different logs than the already existing one. Can you improve the original to understand the logs you want to parse and use it in this PR?

Thanks for your contribution!

Add slow brute-force detection scenarios for Postfix SMTP authentication and evasive HELO rejection attacks: - melite/postfix-slow-bf (leakspeed 900s, capacity 7) - melite/postfix-very-slow-bf (leakspeed 4h, capacity 5) - melite/postfix-submission-very-slow-bf (leakspeed 4h, capacity 5) - melite/postfix-helo-very-slow (leakspeed 4h, capacity 5) Includes parser melite/postfix-submission-auth (s01-parse) for port 587 auth failures invisible to standard parsers, and hub tests.

Address reviewer feedback: add disconnect auth failure detection directly to crowdsecurity/postfix-logs instead of a separate melite/postfix-submission-auth parser. - Add grok node for 'disconnect from ... auth=0/N' pattern - Remove melite/postfix-submission-auth parser and markdown - Update test configs to reference modified parser - Rewrite parser assertions for new pipeline structure All 5 hubtest tests pass (parser + 4 scenarios).

Remove stale reference to deleted melite/postfix-submission-auth parser. The submission auth pattern is now part of crowdsecurity/postfix-logs.

Etilem · 2026-03-27T18:01:47Z

Hi @sabban, thanks for the feedback !

I've removed the custom melite/postfix-submission-auth parser and extended crowdsecurity/postfix-logs instead.

The new grok pattern extracts auth=0/N from Postfix disconnect lines and tags them with log_type_enh : submission-auth-failed.

Changes in commits 5e1ed83 and 1a0f909.

The submission scenarios now reference crowdsecurity/postfix-logs as their dependency.

Let me know if anything else needs adjusting !

Copilot

Pull request overview

This PR adds new CrowdSec Postfix scenarios to detect evasive/slow SMTP AUTH brute-force activity (including submission/587 cases where failures only appear in disconnect summaries) and very-slow HELO rejection spam behavior, along with parser and hubtest updates to support/validate these detections.

Changes:

Add new melite/ leaky-bucket scenarios for slow/very-slow Postfix AUTH brute-force and very-slow HELO rejections (plus _user-enum variants where applicable).
Extend crowdsecurity/postfix-logs to extract auth=0/N from disconnect lines and tag as log_type_enh: submission-auth-failed.
Add hubtests (scenario + parser assertions) for the new scenarios and the new submission disconnect parsing.

Reviewed changes

Copilot reviewed 23 out of 28 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`scenarios/melite/postfix-very-slow-bf.yaml`	Adds a 24h-window Postfix AUTH brute-force scenario and `_user-enum` variant.
`scenarios/melite/postfix-very-slow-bf.md`	Documents the very-slow AUTH brute-force scenario behavior and dependencies.
`scenarios/melite/postfix-submission-very-slow-bf.yaml`	Adds a 24h-window submission/587 brute-force scenario based on disconnect summary auth counters.
`scenarios/melite/postfix-submission-very-slow-bf.md`	Documents the submission/587 scenario and its parser dependency.
`scenarios/melite/postfix-slow-bf.yaml`	Adds a 2h-window “slow” Postfix AUTH brute-force scenario and `_user-enum` variant.
`scenarios/melite/postfix-slow-bf.md`	Documents the slow AUTH brute-force scenario behavior and dependencies.
`scenarios/melite/postfix-helo-very-slow.yaml`	Adds a 24h-window HELO rejection scenario for very slow spammer behavior.
`scenarios/melite/postfix-helo-very-slow.md`	Documents the very-slow HELO rejection scenario behavior and dependencies.
`parsers/s01-parse/crowdsecurity/postfix-logs.yaml`	Extends Postfix parsing to detect `auth=0/N` in disconnect lines and tag events accordingly.
`.tests/postfix-very-slow-bf/scenario.assert`	Verifies the `melite/postfix-very-slow-bf` scenario triggers as expected.
`.tests/postfix-very-slow-bf/postfix-very-slow-bf.log`	Test fixture log for very-slow AUTH failures.
`.tests/postfix-very-slow-bf/parser.assert`	Verifies parser output used by the very-slow AUTH scenario.
`.tests/postfix-very-slow-bf/config.yaml`	Hubtest configuration for the very-slow AUTH scenario.
`.tests/postfix-submission-very-slow-bf/scenario.assert`	Verifies the submission/587 very-slow scenario triggers as expected.
`.tests/postfix-submission-very-slow-bf/postfix-submission-very-slow-bf.log`	Test fixture log with disconnect summary `auth=0/N` lines.
`.tests/postfix-submission-very-slow-bf/parser.assert`	Verifies parsing of `auth_attempts` and `submission-auth-failed` tagging.
`.tests/postfix-submission-very-slow-bf/config.yaml`	Hubtest configuration for the submission/587 scenario.
`.tests/postfix-submission-auth/postfix-submission-auth.log`	Parser-focused fixture to validate `auth=0/N` extraction across hosts.
`.tests/postfix-submission-auth/parser.assert`	Assertions for the submission disconnect parsing behavior.
`.tests/postfix-submission-auth/config.yaml`	Hubtest configuration for the parser-only submission auth extraction test.
`.tests/postfix-slow-bf/scenario.assert`	Verifies the slow AUTH scenario triggers as expected.
`.tests/postfix-slow-bf/postfix-slow-bf.log`	Test fixture log for slow AUTH failures.
`.tests/postfix-slow-bf/parser.assert`	Verifies parser output used by the slow AUTH scenario.
`.tests/postfix-slow-bf/config.yaml`	Hubtest configuration for the slow AUTH scenario.
`.tests/postfix-helo-very-slow/scenario.assert`	Verifies the very-slow HELO rejection scenario triggers as expected.
`.tests/postfix-helo-very-slow/postfix-helo-very-slow.log`	Test fixture log for HELO rejection events.
`.tests/postfix-helo-very-slow/parser.assert`	Verifies parser output used by the very-slow HELO scenario.
`.tests/postfix-helo-very-slow/config.yaml`	Hubtest configuration for the very-slow HELO scenario.

+  - grok:
+      apply_on: message
+      pattern: 'disconnect from %{RELAY} %{DATA}auth=0/%{INT:auth_attempts}'
+      statics:
+        - meta: log_type_enh
+          value: submission-auth-failed


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

sabban · 2026-05-27T11:54:15Z

@copilot review

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot wasn't able to review any files in this pull request.

Copilot

Pull request overview

Copilot reviewed 23 out of 28 changed files in this pull request and generated 9 comments.

+  - grok:
+      apply_on: message
+      pattern: 'disconnect from %{RELAY} %{DATA}auth=0/%{INT:auth_attempts}'
+      statics:
+        - meta: log_type_enh
+          value: submission-auth-failed


+type: leaky
+name: melite/postfix-slow-bf
+description: "Detect slow Postfix SMTP AUTH bruteforce (distributed attacks)"
+filter: "evt.Meta.log_type == 'postfix' && evt.Meta.log_type_enh == 'spam-attempt'"


+type: leaky
+name: melite/postfix-slow-bf_user-enum
+description: "Detect slow Postfix SASL user enumeration"
+filter: "evt.Meta.log_type == 'postfix' && evt.Meta.log_type_enh == 'spam-attempt'"


+description: "Detect slow Postfix SASL user enumeration"
+filter: "evt.Meta.log_type == 'postfix' && evt.Meta.log_type_enh == 'spam-attempt'"
+groupby: evt.Meta.source_ip
+distinct: evt.Meta.sasl_username


+type: leaky
+name: melite/postfix-very-slow-bf
+description: "Detect very slow Postfix SMTP AUTH bruteforce (evasive attacks)"
+filter: "evt.Meta.log_type == 'postfix' && evt.Meta.log_type_enh == 'spam-attempt'"


+type: leaky
+name: melite/postfix-very-slow-bf_user-enum
+description: "Detect very slow Postfix SASL user enumeration"
+filter: "evt.Meta.log_type == 'postfix' && evt.Meta.log_type_enh == 'spam-attempt'"


+description: "Detect very slow Postfix SASL user enumeration"
+filter: "evt.Meta.log_type == 'postfix' && evt.Meta.log_type_enh == 'spam-attempt'"
+groupby: evt.Meta.source_ip
+distinct: evt.Meta.sasl_username


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Etilem force-pushed the feat/postfix-slow-bf branch from 8dabf51 to 11bd514 Compare February 22, 2026 02:06

Étienne LEMÉE and others added 2 commits March 27, 2026 07:44

Etilem force-pushed the feat/postfix-slow-bf branch from 11bd514 to 5e1ed83 Compare March 27, 2026 07:25

docs: update submission scenario to reference crowdsecurity/postfix-logs

1a0f909

Remove stale reference to deleted melite/postfix-submission-auth parser. The submission auth pattern is now part of crowdsecurity/postfix-logs.

sabban self-requested a review May 12, 2026 09:00

sabban self-assigned this May 12, 2026

sabban removed their request for review May 12, 2026 09:00

sabban requested a review from Copilot May 26, 2026 18:24

Copilot started reviewing on behalf of sabban May 26, 2026 18:24 View session

Copilot AI reviewed May 26, 2026

View reviewed changes

Potential fix for pull request finding

15d45a0

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

sabban requested a review from Copilot May 27, 2026 11:56

Copilot started reviewing on behalf of sabban May 27, 2026 11:56 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Copilot stopped reviewing on behalf of sabban due to an error May 27, 2026 11:57
An unexpected error occurred. For more details, see the detailed logs in GitHub Actions.

sabban requested a review from Copilot May 27, 2026 12:01

Copilot AI reviewed May 27, 2026

View reviewed changes

sabban requested a review from Copilot May 27, 2026 12:05

Copilot started reviewing on behalf of sabban May 27, 2026 12:06 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Potential fix for pull request finding

5b3eb7c

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add Postfix slow brute-force and HELO rejection scenarios#1695

feat: add Postfix slow brute-force and HELO rejection scenarios#1695
Etilem wants to merge 5 commits into
crowdsecurity:masterfrom
Etilem:feat/postfix-slow-bf

Etilem commented Feb 21, 2026 •

edited

Loading

Uh oh!

sabban commented Mar 2, 2026

Uh oh!

Etilem commented Mar 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

sabban commented May 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Etilem commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Scenarios

Parser change

Testing

Uh oh!

sabban commented Mar 2, 2026

Uh oh!

Etilem commented Mar 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

sabban commented May 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Etilem commented Feb 21, 2026 •

edited

Loading