Mail Server Attack

[Judahnator]

Im not really sure where this goes, but here is good enough.

 

A few days ago i noticed more network traffic going to my web server than usual. Then when looking at logs and the auto-banned IP's, i noticed that there was an ongoing dictionary attack.

 

The attacker was mostly hitting on common usernames like Alex, Elena, John, Sam, etc. They were also using a wide range of IP's, so banning one didnt stop the attack.

Right now there are about 6IP's banned, and the attack has slowed. How would i go about completely blocking this? I know good old-fashioned strong passwords are the best defense, but id rather not have to deal with this at all.

 

 

Any thoughts?

 

 

Thanks

 

~Judah

[Gofspar]

Im not really sure where this goes, but here is good enough.

 

A few days ago i noticed more network traffic going to my web server than usual. Then when looking at logs and the auto-banned IP's, i noticed that there was an ongoing dictionary attack.

 

The attacker was mostly hitting on common usernames like Alex, Elena, John, Sam, etc. They were also using a wide range of IP's, so banning one didnt stop the attack.

Right now there are about 6IP's banned, and the attack has slowed. How would i go about completely blocking this? I know good old-fashioned strong passwords are the best defense, but id rather not have to deal with this at all.

 

 

Any thoughts?

 

 

Thanks

 

~Judah

block SMTP traffic, lols.

 

iptables -A INPUT -s 0.0.0.0 --dport 25 -j DROP

[Rashy]

He's good... Dont worry about me im just commenting. Ta ta~

[Gofspar]

block SMTP traffic, lols.

 

iptables -A INPUT -s 0.0.0.0 --dport 25 -j DROP

you could also make a script with bash and grep to filter name headers on the email for alex, samatha etc..

[marat569]

use gmail, problem solved.

[awesomes8wc3]

use gmail, problem solved.

You're lucky I can't ban you.

[Blade of Grass]

I would suggest setting up Fail2Ban to automatically ban IP addresses after too many failed attempts.

Other than that, there's really nothing you can do, my Web servers get attacked all the time, so I setup Fail2Ban to permanently ban after a certain amount of temporary bans.

[Judahnator]

I would suggest setting up Fail2Ban to automatically ban IP addresses after too many failed attempts.

Other than that, there's really nothing you can do, my Web servers get attacked all the time, so I setup Fail2Ban to permanently ban after a certain amount of temporary bans.

 

Thanks, ill definitely give it a try