1

I've been getting a lot of log entries that look like this:

Jan 10 10:31:24 auth: Info: passwd-file(management,91.200.12.140): no passwd file: /etc/exim/domains//passwd
Jan 10 10:32:14 auth: Info: passwd-file(scanner,91.200.13.24): no passwd file: /etc/exim/domains//passwd
Jan 10 10:36:49 auth: Info: passwd-file(finance,91.200.12.166): no passwd file: /etc/exim/domains//passwd
Jan 10 10:38:24 auth: Info: passwd-file(accounts,91.200.12.165): no passwd file: /etc/exim/domains//passwd

They're all in the range 91.200.12.* or 91.200.13.* which has many reports for malicious-looking bot activity (example). The usernames it's trying to access don't exist on my system: presumably it's a probing bot, looking to find out what users exist by seeing what type of error or return it gets.

It's quite different to a failed login attempt, which I have a few of in the logs and are accompanied by an extra line, like this:

mmm dd HH:MM:SS auth: Info: passwd-file(username@domain_name.com,XX.XX.XX.XX): no passwd file: /etc/exim/domains/domain_name.com/passwd
mmm dd HH:MM:SS pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<username@domain_name.com>, method=PLAIN, rip=XX.XX.XX.XX, lip=YY.YY.YY.YY

I've added iptables rules for 91.200.12.0/24 and 91.200.13.0/24 for all mail-related ports, but these log entries still keep coming. I have fail2ban but they get around it by probing slowly and varying the IP address used frequently, the same exact IP address is seldom used twice in days/weeks.

What I'm trying to do, is decode these dovecot log entries and work out what this bot is getting Dovecot to actually do, so I can then work out how to shut it down (since whatever it is, IPtables appears to surprisingly not actually stop it).

Obviously, the bots are looking for passwd files (and doing a bad job of it since they're missing the domain names from /etc/exim/domains/some_domain.com/passwd) and obviously, it's using some kind of remote-access dovecot service or feature to do so. What is the Dovecot service or feature that could be behind a auth: Info: passwd-file log entry with no accompanying login-attempt entry?

I've looked through the Dovecot docs on logging and on authentication but couldn't find anything that would answer the question.


Update: I've tried adding auth_debug=yes to dovecot.conf and then restarting Dovecot to see if I can get any more info about what's happening. Here's a more verbose example of what the bot is up to - much more info, but I still can't figure out what it means. It looks like it's somehow able to access some usable information without logging in, which is naturally something I want to shut down:

Jan 10 21:32:19 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth
Jan 10 21:32:19 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libauthdb_ldap.so
Jan 10 21:32:19 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so
Jan 10 21:32:19 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libmech_gssapi.so
Jan 10 21:32:19 auth: Debug: auth client connected (pid=13335)
Jan 10 21:32:19 auth: Debug: client in: AUTH    1   LOGIN   service=smtp    rip=91.200.13.22    lip=MY.IP.ADD.RS    nologin resp=<hidden>
Jan 10 21:32:19 auth: Debug: client out: CONT   1   RAnD0mTxT8y9
Jan 10 21:32:19 auth: Debug: client in: CONT<hidden>
Jan 10 21:32:19 auth: Debug: client out: CONT   1   8y9rAND0MtXt
Jan 10 21:32:19 auth: Debug: client in: CONT<hidden>
Jan 10 21:32:19 auth: Info: passwd-file(bar,91.200.13.22): no passwd file: /etc/exim/domains//passwd
Jan 10 21:32:19 auth: Debug: client out: FAIL   1   user=bar

"bar" appears to be just another random possible username like "management", "scanner", "finance" and "accounts" in my earlier example.

1

I found that they are using an spoofing service to hide the real traces:

2017-01-16 18:01:59 no IP address found for host vps863.hidehost.net (during SMTP connection from [91.200.12.140]) 2017-01-16 18:02:02 dovecot_login authenticator failed for (User) [91.200.12.140]: 535 Incorrect authentication data (set_id=ftpuser) 2017-01-16 18:02:38 no IP address found for host dedic867.hidehost.net (during SMTP connection from [91.200.13.25]) 2017-01-16 18:02:40 dovecot_login authenticator failed for (User) [91.200.13.25]: 535 Incorrect authentication data (set_id=jimmy) 2017-01-16 18:03:09 no host name found for IP address 148.153.1.90

|improve this answer|||||
0

I had exactly the same problem from the same IPs. This IPs are assigned to www.vhoster.net on UKRAINE

inetnum:         91.200.12.0 - 91.200.15.255
netname:         VHOSTER-NET
org:             ORG-PS152-RIPE
remarks:         
remarks:         **********************************Attention***************************************
remarks:         The pool is used other Department!
remarks:         In case of questions related to SPAM, HACKING, SECURITY
remarks:         Please contact directly abuse@vhoster.net
remarks:         tel: +38 (044) 379-28-50; +7 (499) 404-16-45
remarks:         ***********************************************************************************
remarks:         
country:         UA
admin-c:         JCK
tech-c:          JCK
status:          ASSIGNED PI
mnt-by:          RIPE-NCC-END-MNT
mnt-by:          VHOSTER-MNT
mnt-by:          GLUBINA-MNT
mnt-routes:      VHOSTER-MNT
mnt-domains:     VHOSTER-MNT
created:         2007-09-21T12:32:02Z
last-modified:   2016-12-21T11:04:26Z
source:          RIPE

organisation:    ORG-PS152-RIPE
org-name:        PP SKS-LUGAN
org-type:        LIR
address:         Lenina
address:         93400
address:         Sev
address:         UKRAINE
phone:           +380665258035
fax-no:          +380665258035
e-mail:          lir@lugalink.net
admin-c:         TAU-RIPE
abuse-c:         AR17440-RIPE
mnt-ref:         RIPE-NCC-HM-MNT
mnt-ref:         LUGAN-MNT
mnt-by:          RIPE-NCC-HM-MNT
mnt-by:          LUGAN-MNT
created:         2013-09-25T08:41:49Z
last-modified:   2016-07-11T07:26:07Z
source:          RIPE
|improve this answer|||||
  • What did you do to block them? – Phill Healey Dec 31 '17 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.