I've been getting a lot of log entries that look like this:
Jan 10 10:31:24 auth: Info: passwd-file(management,184.108.40.206): no passwd file: /etc/exim/domains//passwd Jan 10 10:32:14 auth: Info: passwd-file(scanner,220.127.116.11): no passwd file: /etc/exim/domains//passwd Jan 10 10:36:49 auth: Info: passwd-file(finance,18.104.22.168): no passwd file: /etc/exim/domains//passwd Jan 10 10:38:24 auth: Info: passwd-file(accounts,22.214.171.124): no passwd file: /etc/exim/domains//passwd
They're all in the range
91.200.13.* which has many reports for malicious-looking bot activity (example). The usernames it's trying to access don't exist on my system: presumably it's a probing bot, looking to find out what users exist by seeing what type of error or return it gets.
It's quite different to a failed login attempt, which I have a few of in the logs and are accompanied by an extra line, like this:
mmm dd HH:MM:SS auth: Info: passwd-file(username@domain_name.com,XX.XX.XX.XX): no passwd file: /etc/exim/domains/domain_name.com/passwd mmm dd HH:MM:SS pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<username@domain_name.com>, method=PLAIN, rip=XX.XX.XX.XX, lip=YY.YY.YY.YY
I've added iptables rules for
126.96.36.199/24 for all mail-related ports, but these log entries still keep coming. I have fail2ban but they get around it by probing slowly and varying the IP address used frequently, the same exact IP address is seldom used twice in days/weeks.
What I'm trying to do, is decode these dovecot log entries and work out what this bot is getting Dovecot to actually do, so I can then work out how to shut it down (since whatever it is, IPtables appears to surprisingly not actually stop it).
Obviously, the bots are looking for passwd files (and doing a bad job of it since they're missing the domain names from
/etc/exim/domains/some_domain.com/passwd) and obviously, it's using some kind of remote-access dovecot service or feature to do so. What is the Dovecot service or feature that could be behind a
auth: Info: passwd-file log entry with no accompanying login-attempt entry?
Update: I've tried adding
dovecot.conf and then restarting Dovecot to see if I can get any more info about what's happening. Here's a more verbose example of what the bot is up to - much more info, but I still can't figure out what it means. It looks like it's somehow able to access some usable information without logging in, which is naturally something I want to shut down:
Jan 10 21:32:19 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth Jan 10 21:32:19 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libauthdb_ldap.so Jan 10 21:32:19 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so Jan 10 21:32:19 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libmech_gssapi.so Jan 10 21:32:19 auth: Debug: auth client connected (pid=13335) Jan 10 21:32:19 auth: Debug: client in: AUTH 1 LOGIN service=smtp rip=188.8.131.52 lip=MY.IP.ADD.RS nologin resp=<hidden> Jan 10 21:32:19 auth: Debug: client out: CONT 1 RAnD0mTxT8y9 Jan 10 21:32:19 auth: Debug: client in: CONT<hidden> Jan 10 21:32:19 auth: Debug: client out: CONT 1 8y9rAND0MtXt Jan 10 21:32:19 auth: Debug: client in: CONT<hidden> Jan 10 21:32:19 auth: Info: passwd-file(bar,184.108.40.206): no passwd file: /etc/exim/domains//passwd Jan 10 21:32:19 auth: Debug: client out: FAIL 1 user=bar
"bar" appears to be just another random possible username like "management", "scanner", "finance" and "accounts" in my earlier example.