Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have recently purchase VPS2 package from knownhost. I created support ticket with authentic information of the account too for setting up the server and fixing some issues. I have been long with it, its just few days. In those few days i got 3 emails notifying that someone is trying to access my account, but i don't know why and who? I just got some notifications like:

Time:     Wed Apr 13 08:12:27 2011 +0000
IP:       74.63.223.72 (US/United States/72-223-63-74.servebyte.net)
Failures: 10 (pop3d)
Interval: 300 seconds
Blocked:  Permanent Block

Log entries:

Apr 13 08:10:57 host dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<root>, method=PLAIN, rip=74.63.223.72, lip=204.197.252.160
Apr 13 08:11:43 host dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=74.63.223.72, lip=204.197.252.160
Apr 13 08:12:17 host dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<webmaster>, method=PLAIN, rip=74.63.223.72, lip=204.197.252.160
Apr 13 08:12:17 host dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=74.63.223.72, lip=204.197.252.160
Apr 13 08:12:19 host dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=74.63.223.72, lip=204.197.252.160
Apr 13 08:12:19 host dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<webmaster>, method=PLAIN, rip=74.63.223.72, lip=204.197.252.160
Apr 13 08:12:21 host dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=74.63.223.72, lip=204.197.252.160
Apr 13 08:12:21 host dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<webmaster>, method=PLAIN, rip=74.63.223.72, lip=204.197.252.160
Apr 13 08:12:23 host dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<webmaster>, method=PLAIN, rip=74.63.223.72, lip=204.197.252.160
Apr 13 08:12:23 host dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=74.63.223.72, lip=204.197.252.160

So what may be objective of such activities to access my account and how can i improve security on it?

share|improve this question

migrated from webmasters.stackexchange.com Apr 13 '11 at 18:10

This question came from our site for pro webmasters.

3 Answers 3

up vote 0 down vote accepted

The entries in the above message are simply failed POP3 logins. It's likely that the IP you currently have was previously in use by another customer of knownhost who was running a POP3 server. There's not much of a threat here as long as your email accounts have nice strong passwords. If you do think these attempts are malicious, you can certainly block the source IP addresses with IPtables, or implement an automatic blocking service like fail2ban.

share|improve this answer

What about providing SSL only Services for POP/IMAP? To lock out these kids with their bruteforce scripts you could use fail2ban which would ban these ips after a configurable amount of unsuccessful connection attempts.

share|improve this answer

I would recommend running john the ripper on your machine for a few days. It will report to you if any passwords are easy to guess. This will help you ensure your passwords and not easily guessed by brute-force methods.

http://www.openwall.com/john/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.