@maybl8 I looked at the abuseipdb.sh script. The general premise is to load ip’s from their free blacklist endpoint. This endpoint is limited to 10,000 ip’s with a requested confidence of at least 90%. The 10K cap is a hard limit based on the subscription plan. IMO this amount of ip’s is really not enough - of course something is better than nothing.
The idea I proposed above is to use a dynamic means of blocking scanners and other undesirables trying to probe your server. It is a work in progress as I’ve discovered a bug (and fix) where traffic to ports used by mailcow itself are ignored from the list. Ip’s from traffic hitting those parts are not added to the block list.
I only want port 25 traffic to hit my server from any ip NOT on the whitelist. Without significant hardening, im not comfortable exposing port 80/443 or other traffic to it from the internet at large. For purposes of ACME, dns01 validation is performed elsewhere with the certs pushed over ssh to the server then necessary containers restarted.
The vps does NOT store my cloudflare api token. I’d be more comfortable with the idea if cloudflare allowed token access to be limited only to the email server’s subdomain (mail.domain.com). Rather, the token’s scope is the entire domain.com. If the vps instance should ever get compromised, the attacker would be able to make broad changes to my entire domain’s zone record.
I’ll review my earlier post a bit later to reflect the updated changes.
@DocFraggle I don’t mean to step on your toes with my method. I think it’s great to see an option to implement a blocklist. Sadly the bitwire blocklist I want to use has over 3m entries and takes forever to import. Seems impractical to do on a vps. The dynamic option appears to be a good alternative, balancing performance and security. For the traffic does make it through to port 25, mailcow does a good job of handling blocking with its own netfilter and spam protection methods.
FWIW, I find lookups from spamhaus free dq service to be invaluable to blocking majority of such traffic at postscreen level. Practically none making it rspamd.
