Dňa 25. júna 2022 15:11:34 UTC používateľ Sebastian Nielsen via Exim-users <exim-users@exim.org> napísal:
>They seem to use wordlists to hack the password. Next week will be one year, from distributed attack to my email system starts, and it is still ongoing. The year is enough time to do with (against) it, but of course i cannot stop it. I can only guess, that it is from multiple relative independed botnets, as i have no power investigate in depth. They all seems to use harvested email addresses as i see a lot of login attempts to email aliases, but most significant part are logins with XMPP accounts (JID -- Jabber ID), which looks as email address, but in my case never had email accounts (they was JIDs used for remote teaching at COVID's lockdowns), thus i do not need to afraid about attack success. Only very small part of this attack used real mail accounts. Initially i even watch on passwords, but the attempts looks as dictionary variations of one (per login) password. But these accounts was removed from server in that time, thus i cannot tell, if they get real passwords with these JIDs, but it is possible... I then stop to watch them. I use 465 (and 993/995) with implicit TLS only (for users) more than two years, small part of attack was filtered by setting TLS1.2+ as requirement, without DHE+RSA and plain RSA, but that doesn't help mutch. Relative quickly i understand, tha fail2ban will not helps with it, as any host tried AUTH only once, and returns only occassionaly. If they returns, it was after relative long time, in days or even weeks (i store its IPs for some months). Then i start to collect its ASNs & IP networks, to see if i can block that. But without luck, they comes from different providers and while some ASNs repeats, it was not significant number. Then i start collect its countries and finally i found pattern -- the US, BR, AR, IN are biggest part of it. There are other countries involved too, including my own, but thay are occasional. I was initially against country blocking, but no other pattern in attacking IPs. I afraid to country block mostly because my users are from in countries and often travel, but by per user BL/WL it is acceptable (at least for me). Then i go into real blocking. As i use dovecot's SASL for SMTP login, i decided to use blocking on the dovecot side, to have them blocked not only for SMTP, but for IMAP and POP3 too. I found that dovecot supports policy daemon, thus i start to play with weakforce (from PowerDNS or so), it looks very good and provides nice functions for per user, per IP or per country counting of failed/success logins and automatically block eg. account from too many IPs (leaked passwords). After i learn to setup and use it i found, that i was not able to build one of its dependencies (and thus to build it self) on oldstable Debian, on which my email system runs at that time... Then i start to develop own policy daemon. Is not as poweful as weakforced, i wrote it in python (and flask) and uses redis as storage, but works great for my small email system for more months. For now it provides: + global country (GeoIP2) BL with per user WL (no UI) + global IP and users BL/WL + configurable DNS RBL fír blocking + success login IP counting with auto users BL (as leaked passwords action) I initialy used relative long list of RBLs (they are queried async, thus no problem), but after some months i reduced it, as some provided false positives (as i mentioned in other post already). It itself doesn't blocks IP (only delays/rejects logins), but i use strict fail2ban's jail, which adds every block from its log to ipset, where IPs are blocked for about 24 days (max ipset's timeot) and its timeout is reset by any attemt in that time by iptables. Today that ipset has about 2200 IPs, the maximum was about 4500 at once. To be honest, most of attempts i block by country (from the same redis BL) directly in exim at connect time yet (as i initially afraid about my policy daemon performance and resource usage), but it survived multiple bursts from not blocked countries already, thus after i finish (ongoing) services migration to new HW i will rely only on dovecot's policy daemon, as on exim's side is per user WL missing. To get country in exim i initally used shell script to query Maxmind DB, but now i use GeoIP dlfunc which i found on github and exim queries redis's BL. I found no one (as mentioned) DNS RBL providing country info for IPv6, thus they are not useful for me (while current attack is IPv4 only). Beside this, i start to distribute fail2ban block between my MX and MSA, as they are serated, by using small python daemon subscribed to redis's PubSub. It is not very usefull in this attack, as only some IPs are accesing both, the 465 and 25 ports yet, but it is nice to have ;-) After initial (when this attack starts) wondering, i now only look at daily logwatch reports, that all works as expected and i only count how many IPs was blocked. Because i do not know, if my leaked password protection works, as i didn't meet it yet, i watch login counts, if they are in usual... Finally, after i finish mentioned migration, i have plan to build honeypot for SMTP/IMAP/POP connections over plain ports with STARTTLS, as i do not offer them to clients, which will use the same user/passwords as real service but will reject all (including success) logins, and will report (block) the success one, but it is only idea yet... I am writing this on my tablet now, thus i have no links here, but if anyone is interested, i can provide them latter, when i will be on PC... regards -- Slavko -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/