Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

routinely I'm seeing lots of login attempts to my mail server trying out various login names starting from A to Z coming from the one IP on one day and another IP on another day. Is there any means to detect this type of activities and block accordingly? I asked Watchguard and it appears they don't support this on their XTM series. Anything else I can do other than to have a super long password?

share|improve this question
    
Are the IP addresses in the same subnet ? Can you limit the number of login attempts ? –  Vinz Nov 5 '13 at 15:17
    
@Vinz No it comes from a variety of IPs. –  user192702 Nov 10 '13 at 12:46

1 Answer 1

This is a typical example of the "background noise" you'll find on most servers exposed to the internet.

A common solution is to have a script parse your log files to find those repeat offenders and then block the originating ip-adresses in the servers local firewall.

fail2ban is one such example.

share|improve this answer
    
Is there a way to block it on the network device level with any UTM devices? I'd tend to think the XTM series would do such thing but apparently not. –  user192702 Nov 10 '13 at 12:47
    
I have no experience with Watchguard products, so I can't help you there. I imagine it also strongly depends on the protocol, a clear text protocol would allow an intrusion detection/prevention appliance easily tally incorrect username/password messages and take action. If the protocol/connection is SSL/TLS encrypted the appliance would need a copy of the private key and actively decrypt all traffic, which I would expect to come at an performance and price premium. Depending on the number and skill level of your legitimate users you could move services to non-default ports. –  HBruijn Nov 10 '13 at 19:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.