feat: add Postfix slow brute-force and HELO rejection scenarios

[Etilem]

Summary

Add slow brute-force detection scenarios for Postfix SMTP authentication (port 25 and port 587) and evasive HELO rejection attacks.
Extends the existing crowdsecurity/postfix-logs parser for submission port auth failures that are invisible to standard parsers.

Developed and tested on a production mail server handling 17 domains, where these scenarios detected persistent evasive attacks that standard Postfix scenarios missed entirely.

Problem

Standard CrowdSec Postfix detection has two major gaps:

1. Slow SASL brute-force on port 25: crowdsecurity/postfix-bf has a short detection window. Attackers spacing attempts 15+ minutes apart evade it completely.

2. Port 587 (submission) auth failures are invisible: When using STARTTLS on port 587, Postfix does NOT log explicit "SASL authentication failed" messages. Auth failures only appear as auth=0/N in disconnect summary lines — no standard parser extracts this information.

3. Slow HELO rejection attacks: crowdsecurity/postfix-helo-rejected has a ~10 minute window. Evasive spammers sending invalid HELO commands ~70 minutes apart go undetected.

Scenarios

Scenario	Leakspeed	Capacity	Window	Use Case
melite/postfix-slow-bf	900s	7	2h	Distributed SASL attacks (port 25)
melite/postfix-very-slow-bf	4h	5	24h	Evasive SASL attacks (port 25)
melite/postfix-submission-very-slow-bf	4h	5	24h	Evasive attacks on port 587
melite/postfix-helo-very-slow	4h	5	24h	Evasive invalid HELO spammers

The first two scenarios include _user-enum variants (using distinct on sasl_username).

Parser change

crowdsecurity/postfix-logs (s01-parse): Extended with a new grok pattern that extracts auth=0/N from Postfix disconnect lines. Tags matching lines with log_type_enh: submission-auth-failed.

Example log that was previously invisible:
postfix/submission/smtpd[1234]: disconnect from unknown[IP] ehlo=1 auth=0/1 quit=1 commands=2/3

Note: Following reviewer feedback, this extends the existing crowdsecurity/postfix-logs parser instead of adding a separate parser.

Testing

cscli hubtest run postfix-slow-bf --save-results
cscli hubtest run postfix-very-slow-bf --save-results
cscli hubtest run postfix-submission-very-slow-bf --save-results
cscli hubtest run postfix-helo-very-slow --save-results
cscli hubtest run postfix-submission-auth --save-results

Dependencies

- crowdsecurity/syslog-logs
- crowdsecurity/postfix-logs
- crowdsecurity/dateparse-enrich

[sabban]

Hi,
Your PR redefines a postfix parser that can parse slightly different logs than the already existing one. Can you improve the original to understand the logs you want to parse and use it in this PR?

Thanks for your contribution!

[Etilem]

Hi @sabban, thanks for the feedback !

I've removed the custom melite/postfix-submission-auth parser and extended crowdsecurity/postfix-logs instead.

The new grok pattern extracts auth=0/N from Postfix disconnect lines and tags them with log_type_enh : submission-auth-failed.

Changes in commits 5e1ed83 and 1a0f909.

The submission scenarios now reference crowdsecurity/postfix-logs as their dependency.

Let me know if anything else needs adjusting !