JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser .
Email break in / attack attempt ?
Hi, I was looking at my exim mainlog, and noticed ALOT of lines like these:
2007-08-17 13:38:27 login authenticator failed for (UATIM-382DBAFEF) [59.35.5.174]: 535 Incorrect authentication data (set_id=admin)***** >***** > rejected RCPT <[email protected] >: authentication required***** >***** > rejected RCPT <[email protected] >: authentication required***** >***** > rejected RCPT <[email protected] >: authentication required
The
***** is the hostname of the main server-ip.
It looks like some kind breaking an entrance / attack attempt.
And it looks like it has been blocked well by Exim (with SpamBlocker2.21 and ClamAV).
Is there anything we & I can learn from this, was it trying to get in via known or unknown holes ?
And perhaps is there some other logs that are interesting in checking out ?
And is there a way to like auto-block the ip after many attempts like these ?
Thanx
Last edited: Aug 17, 2007
Yah if I had my way I would block China-Net all together. Unfortunately I have a U.S. customer that works with a dropship supplier in China who is on a DHCP and bounces around on a large spectrum of IPs. I could probably drop the spam load and attempted exploit load on the servers by 80% if I did block them.
Thanx BigWill
What does smtp_banner = "SMTP" do ?
And btw, I blocked that ip as well.
Last edited: Aug 18, 2007
It reduces the banner to keep hackers and kiddies from identifying the mail server. The less information they have the better.
NoBaloney Internet Svcs - In Memoriam †
Ah, the old security by obscurity argument.
