ConfigServer Community Forum

	if (($lgfile eq $config{POP3D_LOG}) and ($line =~ /^\S+\s+\S+\s+\S+\s+server2 dovecot\: pop3\-login.*auth failed.*user\=\<info\@.*rip\=(\S+)/))  {
		return ("INFO Harvest",$1,"SecmasINFO","3","1");
	}

Feb 19 11:11:11 server dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<info@domain1.com>, method=PLAIN, rip=73.209.48.93, lip=xxx.xxx.xxx.xxx, session=<sg7FkSIsBtNJ0TBd>
Feb 19 11:11:11 server dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<info@domain2.com>, method=PLAIN, rip=73.209.48.93, lip=xxx.xxx.xxx.xxx, session=<I1jFkSIsC9NJ0TBd>
Feb 19 11:11:15 server dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<info@domain3.com>, method=PLAIN, rip=73.209.48.93, lip=xxx.xxx.xxx.xxx, session=<mDrGkSIsENNJ0TBd>

ocahui wrote:This rule is working on a CENTOS7 server running csf with ipset+iptables, and exim MTA. This server is managed primarily with Webmin, bash terminal using an SSH tunnel, and Filezilla SFTP.

The problem this rule addresses is remote hosts that attempt SMTP AUTH, despite not having AUTH advertised in response to EHLO. This would include the case where is AUTH is advertised to a limited list of hosts using csf configuration settings. This rule was developed in response to recent flooding of port 25 with thousands of unsolicited attempts within a few-minute stretch. Although exim automatically drops the connection with a 503 response, thousands of reconnections in a short period can amount to DOS.

An example of a log line this rule detects and bans:

Code: Select all

2016-04-29 09:51:44 [18093] SMTP protocol error in "AUTH LOGIN" H=(VIVACLIENT) [122.160.51.52]:62638 I=[192.168.1.203]:25 AUTH command used when not advertised

(local ip obfuscated with 192.168.1.203)

The custom rule:

Code: Select all

# Custom REGEX for exim to block hosts that attempt AUTH when not advertised (possibly used in conjunction with SMTPAUTH_RESTRICT = "1")
	if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /^\d{4}(\-\d{2}){2} \d{2}(:\d{2}){2} \[\d+\] SMTP protocol error in \"AUTH LOGIN\" H=.*\[(\d+\.\d+\.\d+\.\d+)\]:\d+ I=\[\d+\.\d+\.\d+\.\d+\]:(\d+) AUTH command used when not advertised$/)) 
	{
		if (checkip(\$3)) { return ("SMTP AUTH attempted when not advertised",$3,"mySMTPauthfail","2",$4,"3600");} else {return}
	}
#   IP is captured in $3
#  The local port is captured in $4
#  The scanned log is /var/log/exim/main.log  (ymmv)
#  Because of other CSF config settings, the IP block in my case is one hour on all ports,
#  but the returned arguments block only on the SMTP port used.

Note that this regex depends on the time stamp format shown:
2016-04-29 09:51:44
Some exim installations use different format time stamps, which would require some editing of the regex.

nbeernink wrote:Perhaps the regex we shared in DirectAdmin modsecurity denials not blocked by CSF/LFD can be added to this sticky? Hope it's useful to someone!