feat: add Postfix slow brute-force and HELO rejection scenarios

[Etilem]

Summary

Add slow brute-force detection scenarios for Postfix SMTP authentication (port 25 and port 587) and evasive HELO rejection attacks. Includes a custom parser for submission port (587) auth failures that are invisible to standard parsers.

Developed and tested on a production mail server handling 17 domains, where these scenarios detected persistent evasive attacks that standard Postfix scenarios missed entirely.

Problem

Standard CrowdSec Postfix detection has two major gaps:

1. Slow SASL brute-force on port 25: crowdsecurity/postfix-bf has a short detection window. Attackers spacing attempts 15+ minutes apart evade it completely.

2. Port 587 (submission) auth failures are invisible: When using STARTTLS on port 587, Postfix does NOT log explicit "SASL authentication failed" messages. Auth failures only appear as auth=0/N in disconnect summary lines — no standard parser extracts this information.

3. Slow HELO rejection attacks: crowdsecurity/postfix-helo-rejected has a ~10 minute window. Evasive spammers sending invalid HELO commands ~70 minutes apart go undetected.

Scenarios

Scenario	Leakspeed	Capacity	Window	Use Case
melite/postfix-slow-bf	900s	7	2h	Distributed SASL attacks (port 25)
melite/postfix-very-slow-bf	4h	5	24h	Evasive SASL attacks (port 25)
melite/postfix-submission-very-slow-bf	4h	5	24h	Evasive attacks on port 587
melite/postfix-helo-very-slow	4h	5	24h	Evasive invalid HELO spammers

The first two scenarios include _user-enum variants (using distinct on sasl_username).

Parser

melite/postfix-submission-auth (s02-enrich): Extracts auth=0/N pattern from Postfix disconnect lines. Runs in s02-enrich (after crowdsecurity/postfix-logs parses the line in s01). Tags matching lines with log_type_enh: submission-auth-failed.

Example log that was previously invisible:

postfix/submission/smtpd[1234]: disconnect from unknown[IP] ehlo=1 auth=0/1 quit=1 commands=2/3

Testing

cscli hubtest run postfix-slow-bf --save-results
cscli hubtest run postfix-very-slow-bf --save-results
cscli hubtest run postfix-submission-very-slow-bf --save-results
cscli hubtest run postfix-helo-very-slow --save-results
cscli hubtest run postfix-submission-auth --save-results

Dependencies

• crowdsecurity/syslog-logs
• crowdsecurity/postfix-logs
• crowdsecurity/dateparse-enrich