up vote 1 down vote favorite
share [g+] share [fb]

My linux sendmail server is being forced out of commission by a flood of invalid smtp saslauthd logins.
Steady stream of PAM auth errors logged for saslauthd in messages.
I have searched and searched for a way to determine the IP so I can block it ... no luck.
The IP is not being recorded in the messages or secure logs.
Any advice would be greatly appreciated.

link|improve this question
This needs to be asked on ServerFault...I think you'll have better luck there. – Calvin Froedge Jun 16 '11 at 19:28
Ok, thanks, asking – xivix Jun 16 '11 at 19:31
Use netstat to list the connection details to determine the IP addresses connecting to your SMTP port. – rthomson Jun 17 '11 at 2:53
feedback

3 Answers

up vote 3 down vote

This might help: Blocking SMTP authentication brute force attacks using Fail2Ban

link|improve this answer
Thanks. I have checked that out several times in the past. Fail2Ban is overkill in my situation ... I have a very large iptables that I have built over many years to thwart many attacks. It would be counter-productive for another system to start overwriting or modifying that. I just need to know the IP so I can block it. Can fail2ban do that? How does fail2ban get the IP? If I could know that I could take it from there. – xivix Jun 16 '11 at 19:42
1  
Fail2ban parses relevant logfiles and if it sees multiple failed connection attempts from the same address, it injects a ban rule into the firewall, and after a while lifts this ban, when the bots have given up. – SvenW Jun 16 '11 at 19:55
2  
fail2ban isn't overkill -- it's pretty much exactly what you want in a mostly-automated package... – voretaq7♦ Jun 16 '11 at 19:59
@xivix clearly fail2ban isn't overkill in this situation it's exactly the tool you want. Fail2Ban creates it's own table that it then manages. It does not interfere with your current settings beyond that. – Iain♦ Jun 16 '11 at 20:02
thanks ... I did some research and from what I can tell fail2ban reads logs and the logs need to have the IP in them somewhere. The problem with saslauthd and pam authentication is that they don't log IPs for failed authentication. So fail2ban won't have any data. – xivix Jun 17 '11 at 1:54
show 2 more comments
feedback
up vote 0 down vote

Sendmail logs to the LOG_MAIL facility, which is usually sent to something like /var/log/mail or /var/log/maillog, depending on your operating system. Consult your local /etc/syslog.conf for details. You may find something useful there.

If that doesn't work, you can use the tcpdump to find out who's connecting to your system. If you run it like this:

# tcpdump -i <interface> -n port 25

You'll get a list of traffic on port 25, which will look something like this:

15:41:07.974013 IP 192.168.1.20.58973 > 192.168.1.20.25: Flags [S], seq 3814195426, win 65535, options [mss 16344,nop,wscale 3,sackOK,TS val 393331165 ecr 0], length 0
15:41:07.974041 IP 192.168.1.20.25 > 192.168.1.20.58973: Flags [S.], seq 538844273, ack 3814195427, win 65535, options [mss 16344,nop,wscale 3,sackOK,TS val 3794784629 ecr 393331165], length 0

That's a timestamp, then a protocol, then the source ip address, then the destination ip address. This should give you what you need.

You could also get something similar using the netstat command:

netstat -an | grep :25

This should show connections on port 25 on your local system.

There are a variety of mechanisms for either rate-limiting smtp connections per source address or blocking addresses with a high rate of authentication failures. You can use iptables for the former or something like fail2ban for the latter.

link|improve this answer
Thanks ... the tcpdump does help ... but I have thousands of users on this server all mixed in with the attacker ... how do I associate an attacker IP with an invalid login? – xivix Jun 16 '11 at 19:51
Did you your maillog have useful information? If you're really getting hammered by a remote system (or systems) you should be able to identify them based on traffic. A tool like iptraf would help with this. If you're using unencrypted smtp (yikes!) you could inspect the packet data to see which systems are logging in. You can probably configure sendmail to provide better logging in the event of authentication failures, but I'm not sure off the top of my head. – larsks Jun 16 '11 at 20:02
iptraf looks great too ... please tell me how to do as you suggest (inspect packet data to see which systems are logging in) as I have never used it and am in emergency mode at the moment. I also tried iptables connection limiting and it doesn't even slow it down: iptables -A INPUT -p tcp --dport 25 -m state --state NEW -m recent --set iptables -A INPUT -p tcp --dport 25 -m state --state NEW -m recent --update --seconds 10 --hitcount 8 -j DROP Also did port 587. – xivix Jun 16 '11 at 20:15
feedback
up vote 0 down vote

You have to increase the LogLevel to 10 or more. Look in sendmail.mc or put something like define(confLOG_LEVEL',10')dnl

This will log the IP number on auth failures.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.