0

I have a postfix + dovecot mail server, today while checking my logs I see login attempts from unknown users / ip adresses, I guess this has to be a brute force attack.

How could I stop and eventually prevent this?

Help would be much appreciated!

log:

Aug 24 15:36:34 mail dovecot: auth: passwd-file(zamudio,201.222.55.26): unknown user (SHA1 of given password: f72ac0)
Aug 24 15:36:36 mail postfix/smtpd[12568]: warning: unknown[201.222.55.26]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Aug 24 15:36:36 mail postfix/smtpd[12568]: disconnect from unknown[201.222.55.26] helo=1 auth=0/1 quit=1 commands=2/3
Aug 24 15:38:38 mail postfix/anvil[12413]: statistics: max connection rate 1/60s for (smtp:200.124.242.82) at Aug 24 15:30:49
Aug 24 15:38:38 mail postfix/anvil[12413]: statistics: max connection count 1 for (smtp:200.124.242.82) at Aug 24 15:30:49
Aug 24 15:38:38 mail postfix/anvil[12413]: statistics: max cache size 1 at Aug 24 15:30:49
Aug 24 15:39:34 mail postfix/smtpd[12571]: connect from unknown[190.117.185.251]
Aug 24 15:39:35 mail dovecot: auth: passwd-file(helene,190.117.185.251): unknown user (SHA1 of given password: cb4a0f)
Aug 24 15:39:37 mail postfix/smtpd[12571]: warning: unknown[190.117.185.251]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Aug 24 15:39:37 mail postfix/smtpd[12571]: disconnect from unknown[190.117.185.251] helo=1 auth=0/1 quit=1 commands=2/3
Aug 24 15:42:17 mail postfix/smtpd[12574]: connect from unknown[175.140.139.233]
Aug 24 15:42:18 mail dovecot: auth: passwd-file(payroll,175.140.139.233): unknown user (SHA1 of given password: 4de472)
Aug 24 15:42:20 mail postfix/smtpd[12574]: warning: unknown[175.140.139.233]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Aug 24 15:42:20 mail postfix/smtpd[12574]: disconnect from unknown[175.140.139.233] helo=1 auth=0/1 quit=1 commands=2/3
  • 2
    Personally, I use fail2ban. – roaima Aug 24 '17 at 16:07
  • Thanks for the suggestion, I check fail2ban out. I am wondering, how my server got discovered by attackers so fast while its more in a development stage, started only about 10 days!? – Edmond Tamas Aug 24 '17 at 16:16
  • @EdmondTamas Not strange, there are whole server farms just constantly scanning whole IP blocks for open ports. – Kusalananda Aug 24 '17 at 16:18
  • @Kusalananda, this is kinda sad, I guess this is how things work lately on the web. Shi**. :( – Edmond Tamas Aug 24 '17 at 16:20
  • 1
    "Lately"? It's been going on for years :-( – roaima Aug 24 '17 at 16:31
0

Your server is trying to use as open relay. You need define smtpd_relay_restrictions option. By default it use rules:

smtpd_relay_restrictions = permit_mynetworks,
                           permit_sasl_authenticated, 
                           defer_unauth_destination

Which means that open relay is closed.

As your server is public, you need to humility with the constant attempts from internet bots to send mail through your server.

Or you can block other ips and allow only trusted ips/networks if your server works only as testing environment

  • Is there not a "fail2ban" or something similar for SMTP brute force attacks? – Eugene van der Merwe Mar 5 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.