Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 1 subscriber
  • Views 19114 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SMTP Attacks - Block/Blacklist IP

GZgidnick
Hi guys,

I am failing to find an effective way to blacklist of IP addresses that are generating reoccurring SMTP attacks (Brute force password guessing).

Sophos is used as a Relay host for Exchange.

Please note that I do not want to create deny rules in the firewall and make a complete mess.

I have blacklisted the IP address into:
Email Protection > SMTP > Relaying Tab >  Host/Network Blacklist
however though this seems to not be having any effect as the same IP address are generating more attacks.
Sophos blocks them for 600 sec after to many passwords guessing but that is just not enough.

Is there any way I can maintain IP blacklist on the WAN interface without messing up with IP Tables?


This thread was automatically locked due to age.
Parents
  • 0
    Hi GZgidnick,

    You are right, in my Telnet SMTP testing blacklisted hosts are rejected after RCPT TO command, but UTM allows them AUTH LOGIN which comes earlier in SMTP communication.

    SMTP command order is like:
    [LIST=1]
    • HELO/EHLO
    • AUTH LOGIN (optional)
    • MAIL FROM
    • RCPT TO
    • DATA
    • QUIT
    [/LIST]

    From UTM logs:
    2014:09:01-11:52:54 utm exim-in[30205]: 2014-09-01 11:52:54 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="*.*.111.140" from="vilic@****" to="vilic@***" size="-1" reason="host_blacklist" extra="*.*.111.140 blacklisted"
    2014:09:01-11:52:54 utm exim-in[30205]: 2014-09-01 11:52:54 H=(test.test.com) [*.*.111.140]:61829 F= rejected RCPT vilic@****: Access denied (host blacklisted)


    2014:09:01-11:59:05 utm exim-in[30379]: 2014-09-01 11:59:05 server_login authenticator failed for (test.test.com) [*.*.111.140]:62020: 535 Incorrect authentication data (set_id=vilic)
Reply
  • 0
    Hi GZgidnick,

    You are right, in my Telnet SMTP testing blacklisted hosts are rejected after RCPT TO command, but UTM allows them AUTH LOGIN which comes earlier in SMTP communication.

    SMTP command order is like:
    [LIST=1]
    • HELO/EHLO
    • AUTH LOGIN (optional)
    • MAIL FROM
    • RCPT TO
    • DATA
    • QUIT
    [/LIST]

    From UTM logs:
    2014:09:01-11:52:54 utm exim-in[30205]: 2014-09-01 11:52:54 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="*.*.111.140" from="vilic@****" to="vilic@***" size="-1" reason="host_blacklist" extra="*.*.111.140 blacklisted"
    2014:09:01-11:52:54 utm exim-in[30205]: 2014-09-01 11:52:54 H=(test.test.com) [*.*.111.140]:61829 F= rejected RCPT vilic@****: Access denied (host blacklisted)


    2014:09:01-11:59:05 utm exim-in[30379]: 2014-09-01 11:59:05 server_login authenticator failed for (test.test.com) [*.*.111.140]:62020: 535 Incorrect authentication data (set_id=vilic)
Children
No Data
Unfiltered HTML