I run my own email server, and a friend received a compromised laptop from work which resulted in a spam attack from Russia yesterday. Turtle settings saved the days with thousands of emails still in the queue when I saw the problem, however it made me realize that everyone with accounts on my server are local, do not travel, and have no requirement to send emails from outside the country.

I found how to use the smtpd_discard_ehlo_keyword_address_maps setting in postfix to block a CIDR list of IPs, then found a maintained list of IPs by country codes on github. Cool so far, and a script to keep my local list updated was easy enough.

Now the question is, what countries should I be blocking? There are plenty of lists of the top hacking sources, but it’s hard to block #2 (the US) when that’s where I am located. But otherwise, does anyone have a list of countries they outright block from logging on to their servers? From the above google searches I have 17 countries blocked so far, and in the first 30 minutes already stopped login attempts from three of those countries, so it appears to be working.

Of course I could write a script to parse my logs to see who has already made attempts, but that’s what services like fail2ban are for, and I’m just wondering if there are any countries in particular I should directly block? My list so far includes the following: ae bg br cn de hk id in ir iq il kp ng ru sa th vn

The question itself may not be that interesting, but I thought at the very least some folks might be interested in my experience and think about doing something similar themselves. I can post more details of what I did if there is any interest.

  • Hyzerflip@lemmy.world
    link
    fedilink
    English
    arrow-up
    15
    arrow-down
    1
    ·
    1 year ago

    I block North Korea, Russia, Ukraine and China. Your mileage may vary depending on your resources required.

    • ShdwdrgnOP
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      1
      ·
      1 year ago

      Ukraine? That’s curious, is that because of the continued Russian occupation or was there another reason?

      • Aux@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        arrow-down
        1
        ·
        1 year ago

        You can safely block the whole of xUSSR because of shared hacking mentality. Source: born and raised in xUSSR.

        • ShdwdrgnOP
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          Oh wait, I just realized you were referring to all of the countries under Russian influence, not just Russia itself. If I can ask, which countries do you think that encompasses? As someone from the other side of the planet, I’m not really too familiar with the politics.

        • ShdwdrgnOP
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          1
          ·
          1 year ago

          They were the first one on my list! 😆