Username/Password guessing protection?

[jglazer]

Is there some way to configure mailenable such that when someone tries to connect and guess usernames or passwords it blocks the IP?

Someone has been attacking my mail server and there are a ton of attempts at usernames like

a@domain.com
b@domain.com
c@domain.com
...

All from the same IP. I would think you can block the IP if this kind of activity is detected. Where, in the myriad of settings, can I set this up?

Here is an excerpt from the log file. In my opinion 192.185.81.63 should have been added to a black list:

05/06/17 01:03:17 SMTP-IN A4C8F2212B92419E991BADA72893A939.MAI 1272 192.185.81.63 220 mydomain.com ESMTP MailEnable Service, Version: 9.70--9.70 ready at 05/06/17 01:03:17 0 0
05/06/17 01:03:17 SMTP-IN A4C8F2212B92419E991BADA72893A939.MAI 1272 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 7 extensions 175 25
05/06/17 01:03:17 SMTP-IN A4C8F2212B92419E991BADA72893A939.MAI 1272 192.185.81.63 STARTTLS 24 10
05/06/17 01:03:17 SMTP-IN A4C8F2212B92419E991BADA72893A939.MAI 1272 192.185.81.63 STARTTLS STARTTLS 24 10
05/06/17 01:03:17 SMTP-IN A4C8F2212B92419E991BADA72893A939.MAI 1272 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 6 extensions 161 25
05/06/17 01:03:17 SMTP-IN A4C8F2212B92419E991BADA72893A939.MAI 1272 192.185.81.63 AUTH AUTH LOGIN 334 VXNlcm5hbWU6 18 12
05/06/17 01:03:18 SMTP-IN A4C8F2212B92419E991BADA72893A939.MAI 1272 192.185.81.63 AUTH {blank} 334 UGFzc3dvcmQ6 18 26 me@mydomain.com
05/06/17 01:03:18 SMTP-IN A4C8F2212B92419E991BADA72893A939.MAI 1272 192.185.81.63 AUTH ZG92MWxsZQ== 535 Invalid Username or Password 34 14 me@mydomain.com
05/06/17 01:03:18 SMTP-IN A4C8F2212B92419E991BADA72893A939.MAI 1272 192.185.81.63 QUIT QUIT 221 Service closing TLS SSL transmission session 50 6 me@mydomain.com
05/06/17 01:03:18 SMTP-IN 2DD199F21A464C459FE5AD1D92FD6474.MAI 1064 192.185.81.63 220 mydomain.com ESMTP MailEnable Service, Version: 9.70--9.70 ready at 05/06/17 01:03:18 0 0
05/06/17 01:03:18 SMTP-IN 2DD199F21A464C459FE5AD1D92FD6474.MAI 1064 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 7 extensions 175 25
05/06/17 01:03:18 SMTP-IN 2DD199F21A464C459FE5AD1D92FD6474.MAI 1064 192.185.81.63 STARTTLS 24 10
05/06/17 01:03:18 SMTP-IN 2DD199F21A464C459FE5AD1D92FD6474.MAI 1064 192.185.81.63 STARTTLS STARTTLS 24 10
05/06/17 01:03:18 SMTP-IN 2DD199F21A464C459FE5AD1D92FD6474.MAI 1064 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 6 extensions 161 25
05/06/17 01:03:18 SMTP-IN 2DD199F21A464C459FE5AD1D92FD6474.MAI 1064 192.185.81.63 AUTH AUTH LOGIN 334 VXNlcm5hbWU6 18 12
05/06/17 01:03:18 SMTP-IN 2DD199F21A464C459FE5AD1D92FD6474.MAI 1064 192.185.81.63 AUTH {blank} 334 UGFzc3dvcmQ6 18 26 me@mydomain.com
05/06/17 01:03:18 SMTP-IN 2DD199F21A464C459FE5AD1D92FD6474.MAI 1064 192.185.81.63 AUTH ZG92MWxsZQ== 535 Invalid Username or Password 34 14 me@mydomain.com
05/06/17 01:03:18 SMTP-IN 2DD199F21A464C459FE5AD1D92FD6474.MAI 1064 192.185.81.63 QUIT QUIT 221 Service closing TLS SSL transmission session 50 6 me@mydomain.com
05/06/17 01:03:18 SMTP-IN 30D1FE315FD641E8A629638AF62A8497.MAI 1256 192.185.81.63 220 mydomain.com ESMTP MailEnable Service, Version: 9.70--9.70 ready at 05/06/17 01:03:18 0 0
05/06/17 01:03:18 SMTP-IN 30D1FE315FD641E8A629638AF62A8497.MAI 1256 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 7 extensions 175 25
05/06/17 01:03:18 SMTP-IN 30D1FE315FD641E8A629638AF62A8497.MAI 1256 192.185.81.63 STARTTLS 24 10
05/06/17 01:03:18 SMTP-IN 30D1FE315FD641E8A629638AF62A8497.MAI 1256 192.185.81.63 STARTTLS STARTTLS 24 10
05/06/17 01:03:18 SMTP-IN 30D1FE315FD641E8A629638AF62A8497.MAI 1256 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 6 extensions 161 25
05/06/17 01:03:18 SMTP-IN 30D1FE315FD641E8A629638AF62A8497.MAI 1256 192.185.81.63 AUTH AUTH LOGIN 334 VXNlcm5hbWU6 18 12
05/06/17 01:03:18 SMTP-IN 30D1FE315FD641E8A629638AF62A8497.MAI 1256 192.185.81.63 AUTH {blank} 334 UGFzc3dvcmQ6 18 26 me@mydomain.com
05/06/17 01:03:18 SMTP-IN 30D1FE315FD641E8A629638AF62A8497.MAI 1256 192.185.81.63 AUTH ZG92MWxsZQ== 535 Invalid Username or Password 34 14 me@mydomain.com
05/06/17 01:03:18 SMTP-IN 30D1FE315FD641E8A629638AF62A8497.MAI 1256 192.185.81.63 QUIT QUIT 221 Service closing TLS SSL transmission session 50 6 me@mydomain.com
05/06/17 01:03:19 SMTP-IN 8C71747A8ACD4E7F9CFB420E7FF00BF4.MAI 1352 192.185.81.63 220 mydomain.com ESMTP MailEnable Service, Version: 9.70--9.70 ready at 05/06/17 01:03:19 0 0
05/06/17 01:03:19 SMTP-IN 8C71747A8ACD4E7F9CFB420E7FF00BF4.MAI 1352 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 7 extensions 175 25
05/06/17 01:03:19 SMTP-IN 8C71747A8ACD4E7F9CFB420E7FF00BF4.MAI 1352 192.185.81.63 STARTTLS 24 10
05/06/17 01:03:19 SMTP-IN 8C71747A8ACD4E7F9CFB420E7FF00BF4.MAI 1352 192.185.81.63 STARTTLS STARTTLS 24 10
05/06/17 01:03:19 SMTP-IN 8C71747A8ACD4E7F9CFB420E7FF00BF4.MAI 1352 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 6 extensions 161 25
05/06/17 01:03:19 SMTP-IN 8C71747A8ACD4E7F9CFB420E7FF00BF4.MAI 1352 192.185.81.63 AUTH AUTH LOGIN 334 VXNlcm5hbWU6 18 12
05/06/17 01:03:19 SMTP-IN 8C71747A8ACD4E7F9CFB420E7FF00BF4.MAI 1352 192.185.81.63 AUTH {blank} 334 UGFzc3dvcmQ6 18 26 me@mydomain.com
05/06/17 01:03:19 SMTP-IN 8C71747A8ACD4E7F9CFB420E7FF00BF4.MAI 1352 192.185.81.63 AUTH ZG92MWxsZQ== 535 Invalid Username or Password 34 14 me@mydomain.com
05/06/17 01:03:19 SMTP-IN 8C71747A8ACD4E7F9CFB420E7FF00BF4.MAI 1352 192.185.81.63 QUIT QUIT 221 Service closing TLS SSL transmission session 50 6 me@mydomain.com
05/06/17 01:03:19 SMTP-IN 9BC45959B06446C7BF03C14AFD88DBA9.MAI 1388 192.185.81.63 220 mydomain.com ESMTP MailEnable Service, Version: 9.70--9.70 ready at 05/06/17 01:03:19 0 0
05/06/17 01:03:19 SMTP-IN 9BC45959B06446C7BF03C14AFD88DBA9.MAI 1388 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 7 extensions 175 25
05/06/17 01:03:19 SMTP-IN 9BC45959B06446C7BF03C14AFD88DBA9.MAI 1388 192.185.81.63 STARTTLS 24 10
05/06/17 01:03:19 SMTP-IN 9BC45959B06446C7BF03C14AFD88DBA9.MAI 1388 192.185.81.63 STARTTLS STARTTLS 24 10
05/06/17 01:03:19 SMTP-IN 9BC45959B06446C7BF03C14AFD88DBA9.MAI 1388 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 6 extensions 161 25
05/06/17 01:03:19 SMTP-IN 9BC45959B06446C7BF03C14AFD88DBA9.MAI 1388 192.185.81.63 AUTH AUTH LOGIN 334 VXNlcm5hbWU6 18 12
05/06/17 01:03:19 SMTP-IN 9BC45959B06446C7BF03C14AFD88DBA9.MAI 1388 192.185.81.63 AUTH {blank} 334 UGFzc3dvcmQ6 18 26 me@mydomain.com
05/06/17 01:03:19 SMTP-IN 9BC45959B06446C7BF03C14AFD88DBA9.MAI 1388 192.185.81.63 AUTH ZG92MWxsZQ== 535 Invalid Username or Password 34 14 me@mydomain.com
05/06/17 01:03:19 SMTP-IN 9BC45959B06446C7BF03C14AFD88DBA9.MAI 1388 192.185.81.63 QUIT QUIT 221 Service closing TLS SSL transmission session 50 6 me@mydomain.com
05/06/17 01:03:19 SMTP-IN ADDD628D3D604A01B68BDC63A1F3B701.MAI 1364 192.185.81.63 220 mydomain.com ESMTP MailEnable Service, Version: 9.70--9.70 ready at 05/06/17 01:03:19 0 0
05/06/17 01:03:19 SMTP-IN ADDD628D3D604A01B68BDC63A1F3B701.MAI 1364 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 7 extensions 175 25
05/06/17 01:03:20 SMTP-IN ADDD628D3D604A01B68BDC63A1F3B701.MAI 1364 192.185.81.63 STARTTLS 24 10
05/06/17 01:03:20 SMTP-IN ADDD628D3D604A01B68BDC63A1F3B701.MAI 1364 192.185.81.63 STARTTLS STARTTLS 24 10
05/06/17 01:03:20 SMTP-IN ADDD628D3D604A01B68BDC63A1F3B701.MAI 1364 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 6 extensions 161 25
05/06/17 01:03:20 SMTP-IN ADDD628D3D604A01B68BDC63A1F3B701.MAI 1364 192.185.81.63 AUTH AUTH LOGIN 334 VXNlcm5hbWU6 18 12
05/06/17 01:03:20 SMTP-IN ADDD628D3D604A01B68BDC63A1F3B701.MAI 1364 192.185.81.63 AUTH {blank} 334 UGFzc3dvcmQ6 18 26 me@mydomain.com
05/06/17 01:03:20 SMTP-IN ADDD628D3D604A01B68BDC63A1F3B701.MAI 1364 192.185.81.63 AUTH ZG92MWxsZQ== 535 Invalid Username or Password 34 14 me@mydomain.com
05/06/17 01:03:20 SMTP-IN ADDD628D3D604A01B68BDC63A1F3B701.MAI 1364 192.185.81.63 QUIT QUIT 221 Service closing TLS SSL transmission session 50 6 me@mydomain.com
05/06/17 01:03:20 SMTP-IN 4DBE44FE9E154A96890816912AB3E5FE.MAI 1348 192.185.81.63 220 mydomain.com ESMTP MailEnable Service, Version: 9.70--9.70 ready at 05/06/17 01:03:20 0 0
05/06/17 01:03:20 SMTP-IN 4DBE44FE9E154A96890816912AB3E5FE.MAI 1348 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 7 extensions 175 25
05/06/17 01:03:20 SMTP-IN 4DBE44FE9E154A96890816912AB3E5FE.MAI 1348 192.185.81.63 STARTTLS 24 10
05/06/17 01:03:20 SMTP-IN 4DBE44FE9E154A96890816912AB3E5FE.MAI 1348 192.185.81.63 STARTTLS STARTTLS 24 10
05/06/17 01:03:20 SMTP-IN 4DBE44FE9E154A96890816912AB3E5FE.MAI 1348 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 6 extensions 161 25
05/06/17 01:03:20 SMTP-IN 4DBE44FE9E154A96890816912AB3E5FE.MAI 1348 192.185.81.63 AUTH AUTH LOGIN 334 VXNlcm5hbWU6 18 12
05/06/17 01:03:20 SMTP-IN 4DBE44FE9E154A96890816912AB3E5FE.MAI 1348 192.185.81.63 AUTH {blank} 334 UGFzc3dvcmQ6 18 26 me@mydomain.com
05/06/17 01:03:20 SMTP-IN 4DBE44FE9E154A96890816912AB3E5FE.MAI 1348 192.185.81.63 AUTH ZG92MWxsZQ== 535 Invalid Username or Password 34 14 me@mydomain.com
05/06/17 01:03:20 SMTP-IN 4DBE44FE9E154A96890816912AB3E5FE.MAI 1348 192.185.81.63 QUIT QUIT 221 Service closing TLS SSL transmission session 50 6 me@mydomain.com
05/06/17 01:03:20 SMTP-IN 1CCF8D39A207439794C5A296D4A6F355.MAI 1272 192.185.81.63 220 mydomain.com ESMTP MailEnable Service, Version: 9.70--9.70 ready at 05/06/17 01:03:20 0 0
05/06/17 01:03:20 SMTP-IN 1CCF8D39A207439794C5A296D4A6F355.MAI 1272 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 7 extensions 175 25
05/06/17 01:03:20 SMTP-IN 1CCF8D39A207439794C5A296D4A6F355.MAI 1272 192.185.81.63 STARTTLS 24 10
05/06/17 01:03:20 SMTP-IN 1CCF8D39A207439794C5A296D4A6F355.MAI 1272 192.185.81.63 STARTTLS STARTTLS 24 10
05/06/17 01:03:20 SMTP-IN 1CCF8D39A207439794C5A296D4A6F355.MAI 1272 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 6 extensions 161 25
05/06/17 01:03:20 SMTP-IN 1CCF8D39A207439794C5A296D4A6F355.MAI 1272 192.185.81.63 AUTH AUTH LOGIN 334 VXNlcm5hbWU6 18 12
05/06/17 01:03:20 SMTP-IN 1CCF8D39A207439794C5A296D4A6F355.MAI 1272 192.185.81.63 AUTH {blank} 334 UGFzc3dvcmQ6 18 26 me@mydomain.com
05/06/17 01:03:21 SMTP-IN 1CCF8D39A207439794C5A296D4A6F355.MAI 1272 192.185.81.63 AUTH ZG92MWxsZQ== 535 Invalid Username or Password 34 14 me@mydomain.com
05/06/17 01:03:21 SMTP-IN 1CCF8D39A207439794C5A296D4A6F355.MAI 1272 192.185.81.63 QUIT QUIT 221 Service closing TLS SSL transmission session 50 6 me@mydomain.com
05/06/17 01:03:21 SMTP-IN 0E298A9198BF45EF914748745D4CDABB.MAI 1064 192.185.81.63 220 mydomain.com ESMTP MailEnable Service, Version: 9.70--9.70 ready at 05/06/17 01:03:21 0 0
05/06/17 01:03:21 SMTP-IN 0E298A9198BF45EF914748745D4CDABB.MAI 1064 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 7 extensions 175 25
05/06/17 01:03:21 SMTP-IN 0E298A9198BF45EF914748745D4CDABB.MAI 1064 192.185.81.63 STARTTLS 24 10
05/06/17 01:03:21 SMTP-IN 0E298A9198BF45EF914748745D4CDABB.MAI 1064 192.185.81.63 STARTTLS STARTTLS 24 10
05/06/17 01:03:21 SMTP-IN 0E298A9198BF45EF914748745D4CDABB.MAI 1064 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 6 extensions 161 25
05/06/17 01:03:21 SMTP-IN 0E298A9198BF45EF914748745D4CDABB.MAI 1064 192.185.81.63 AUTH AUTH LOGIN 334 VXNlcm5hbWU6 18 12
05/06/17 01:03:21 SMTP-IN 0E298A9198BF45EF914748745D4CDABB.MAI 1064 192.185.81.63 AUTH {blank} 334 UGFzc3dvcmQ6 18 26 me@mydomain.com
05/06/17 01:03:21 SMTP-IN 0E298A9198BF45EF914748745D4CDABB.MAI 1064 192.185.81.63 AUTH ZG92MWxsZQ== 535 Invalid Username or Password 34 14 me@mydomain.com
05/06/17 01:03:21 SMTP-IN 0E298A9198BF45EF914748745D4CDABB.MAI 1064 192.185.81.63 QUIT QUIT 221 Service closing TLS SSL transmission session 50 6 me@mydomain.com
05/06/17 01:03:21 SMTP-IN A231AF2E98C643A29F9D0EFECAF5A8BD.MAI 1256 192.185.81.63 220 mydomain.com ESMTP MailEnable Service, Version: 9.70--9.70 ready at 05/06/17 01:03:21 0 0
05/06/17 01:03:21 SMTP-IN A231AF2E98C643A29F9D0EFECAF5A8BD.MAI 1256 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 7 extensions 175 25
05/06/17 01:03:21 SMTP-IN A231AF2E98C643A29F9D0EFECAF5A8BD.MAI 1256 192.185.81.63 STARTTLS 24 10
05/06/17 01:03:21 SMTP-IN A231AF2E98C643A29F9D0EFECAF5A8BD.MAI 1256 192.185.81.63 STARTTLS STARTTLS 24 10
05/06/17 01:03:21 SMTP-IN A231AF2E98C643A29F9D0EFECAF5A8BD.MAI 1256 192.185.81.63 EHLO EHLO www.alwasi-ent.com 250-mydomain.com [192.185.81.63], this server offers 6 extensions 161 25
05/06/17 01:03:21 SMTP-IN A231AF2E98C643A29F9D0EFECAF5A8BD.MAI 1256 192.185.81.63 AUTH AUTH LOGIN 334 VXNlcm5hbWU6 18 12
05/06/17 01:03:21 SMTP-IN A231AF2E98C643A29F9D0EFECAF5A8BD.MAI 1256 192.185.81.63 AUTH {blank} 334 UGFzc3dvcmQ6 18 26 me@mydomain.com
05/06/17 01:03:21 SMTP-IN A231AF2E98C643A29F9D0EFECAF5A8BD.MAI 1256 192.185.81.63 AUTH ZG92MWxsZQ== 535 Invalid Username or Password 34 14 me@mydomain.com
05/06/17 01:03:21 SMTP-IN A231AF2E98C643A29F9D0EFECAF5A8BD.MAI 1256 192.185.81.63 QUIT QUIT 221 Service closing TLS SSL transmission session 50 6 me@mydomain.com


Thanks!

[MailEnable-Ian]

Hi,

You need to enable the "Abuse detection and prevention" option:

http://www.mailenable.com/documentation ... icies.html

[bitechbobbrenner]

We have noticed within our AUDIT logs unusually high activity as compared to in the past. One common denominator with all has been the E hello as "HELO *.*", below is a snippet from our SMTP logs. Also login attempts, for the most, have been with username in alphabetical sequence.

07/16/17 23:58:50 SMTP-IN C9E5F525E8A546F595817C898238F671.MAI 2032 46.102.230.94 HELO HELO *.* 250 Requested mail action okay, completed 43 10
07/16/17 23:58:50 SMTP-IN C9E5F525E8A546F595817C898238F671.MAI 2032 46.102.230.94 AUTH AUTH LOGIN 334 VXNlcm5hbWU6 18 12
07/16/17 23:58:50 SMTP-IN C9E5F525E8A546F595817C898238F671.MAI 2032 46.102.230.94 AUTH {blank} 334 UGFzc3dvcmQ6 18 10 step
07/16/17 23:58:50 SMTP-IN C9E5F525E8A546F595817C898238F671.MAI 2032 46.102.230.94 AUTH MTIzNDU2 535 Invalid Username or Password 34 10 step

Obviously "*.*" shouldn't be added to the EHLO Blocking within the SMTP Properties/Security. In our experience the dictionaries attacks are coming from a broad range of IP's that rarely repeated and if repeated will be spanned over multiple days therefore blocking it by IP numbers would be fruitless. Does anybody know of another way to prevent what appears to be Dictionary Attacks other that blocking the IP number? What I'm looking for is way for ME to see the connecting host as, "*.*", and automatically dropping the session.

ME Enterprise v 9.75
"Abuse detection and prevention" option: is on

[MailEnable-Ian]

Hi,

Have you tried adding the "*.*" string to the SMTP "EHLO BLocking" option? It's located under the SMTP properties within the "Security" tab.

[bitechbobbrenner]

Just now added the "*.*" string to the SMTP "EHLO Blocking" option and it blocks all inbound traffic.

[MailEnable-Ian]

Hi,

Just now added the "*.*" string to the SMTP "EHLO Blocking" option and it blocks all inbound traffic.

I just checked our issue register and this is a known bug that will addressed in the upcoming version. Don't have a specific date sorry.

[bitechbobbrenner]

Hello Ian,

Thank you for the quick reply and addressing it in the next version! Interestingly enough I just ran some quick calculations between yesterdays Audit and SMTP logs, 76% of the dictionary attacks were coming in with the *.* ehlo client.

Thank you again!