POP / IMAP server under attack : what risks and how to secure?

Question

Since yesterday (7am), our POP server is under a dictionnary attack : this is what I found in /var/log/mail.log :

Mar 26 10:31:36 serv pop3d: LOGIN FAILED, user=monday, ip=[::ffff:91.121.**.***]
Mar 26 10:31:41 serv pop3d: Disconnected, ip=[::ffff:91.121.**.***]
Mar 26 10:31:41 serv pop3d: Connection, ip=[::ffff:91.121.**.***]
Mar 26 10:31:41 serv pop3d: LOGIN FAILED, user=monica, ip=[::ffff:91.121.**.***]
Mar 26 10:31:46 serv pop3d: Disconnected, ip=[::ffff:91.121.**.***]
Mar 26 10:31:46 serv pop3d: Connection, ip=[::ffff:91.121.**.***]
Mar 26 10:31:46 serv pop3d: LOGIN FAILED, user=monroe, ip=[::ffff:91.121.**.***]
Mar 26 10:31:51 serv pop3d: Disconnected, ip=[::ffff:91.121.**.***]
Mar 26 10:31:51 serv pop3d: Connection, ip=[::ffff:91.121.**.***]
Mar 26 10:31:51 serv pop3d: LOGIN FAILED, user=montana, ip=[::ffff:91.121.**.***]
Mar 26 10:31:56 serv pop3d: Disconnected, ip=[::ffff:91.121.**.***]

The IP leads to an agency serv. We warned them their security seams broken, and they answer they were aware of that and they were working on it.

But since yesterday 22pm, the IP changes and the new dosen't lead to anything. The IP seems to be blacklisted on some servers (TornevallNET, Spamhaus and CBL_AbuseAt).

Before it was on try each 5 seconds, now it's every second :

Mar 27 00:00:57 serv pop3d: Connection, ip=[::ffff:176.61.***.***]
Mar 27 00:00:58 serv pop3d: LOGIN FAILED, user=info, ip=[::ffff:176.61.***.***]
Mar 27 00:00:59 serv pop3d: Maximum connection limit reached for ::ffff:176.61.***.***
Mar 27 00:00:59 serv pop3d: Maximum connection limit reached for ::ffff:176.61.***.***
Mar 27 00:01:00 serv pop3d: LOGOUT, ip=[::ffff:176.61.***.***]
Mar 27 00:01:00 serv pop3d: Disconnected, ip=[::ffff:176.61.***.***]
Mar 27 00:01:01 serv pop3d: LOGOUT, ip=[::ffff:176.61.***.***]
Mar 27 00:01:01 serv pop3d: Disconnected, ip=[::ffff:176.61.***.***]
Mar 27 00:01:01 serv pop3d: Connection, ip=[::ffff:176.61.***.***]
Mar 27 00:01:01 serv pop3d: Maximum connection limit reached for ::ffff:176.61.***.***

And then they start the same thing on imap :

Mar 27 00:07:08 serv imapd: Connection, ip=[::ffff:176.61.***.***]
Mar 27 00:07:09 serv imapd: LOGIN FAILED, user=web, ip=[::ffff:176.61.***.***]
Mar 27 00:07:09 serv imapd: Disconnected, ip=[::ffff:176.61.***.***], time=6
Mar 27 00:07:09 serv imapd: Connection, ip=[::ffff:176.61.***.***]

That seems to have stop 25 minutes later, the IP changes again, and now, its :

Mar 27 10:20:01 serv postfix/smtpd[10390]: connect from localhost[127.0.0.1]
Mar 27 10:20:01 serv postfix/smtpd[10390]: lost connection after CONNECT from localhost[127.0.0.1]
Mar 27 10:20:01 serv postfix/smtpd[10390]: disconnect from localhost[127.0.0.1]
Mar 27 10:22:33 serv imapd: Connection, ip=[::ffff:88.190.***.**]
Mar 27 10:22:33 serv imapd: Disconnected, ip=[::ffff:88.190.***.**], time=0

Why is it still connexions from a stranger IP on our server ?

On our web production server, we don't use POP or IMAP, but SMTP with postfix. Relay is on our DNS provider.

What's happening ?

Thanks by advance and sorry for my english.

Answer 1

Sorry I need to add an answer because I still can't add comments. But Whatever you do you will ALWAYS have another IP address spamming you and brute forcing you. Best thing to do is block them and hope you don't have user admin with 1234 as a password. I've been through that with my Imap server. I feel your pain. But as Michael said, Welcome to the Internet. cheers

Answer 2

The risk of having a system compromised depends all on the security policies you have in place and how effective these are against your attackers.

If you have strong password policies, account lockouts (after a certain amount of unsuccessful logon attempts), source tracking (i.e. locking out IP addresses that send a large volume of unsuccessful authentication request to your server) and auditing in place you won't have much to worry about.

On the other hand, if you do not have these measures in place, you might be too late now to close it down and you should evaluate the risk & damage this could cause to your business. If the risk is too high to take, take the system offline, secure it and plug it back in. Securing a non-compromised system is always easier than recovering a compromised system.

Answer 3

Have you considered using secured versions for IMAP/POP3? While it won't stop attempts like this, because they are on different ports other than 110 and 143, it might "help".

Unless you have a huge user base, it might be easier to simply move port 110 and 143 to some non standard port numbers. This is a piss poor solution honestly as it doesn't address any security concerns. But it would likely work for small groups unless you have a big crew who can go around and reconfigure all the end user mail clients.

Or if you know where your users are connecting from, limit the connections to POP3 and IMAP to those subnets.