Our web server is currently undergoing a botnet attack on Exim.

Our server is CentOS and is setup with BFD (Brute Force detect that uses APF to prevent access) to detect attempts and block them. This setup works 99% of the time, however since Friday we have been under a distributed dictionary attack to gain access to email accounts.

I have adjusted BFD to trigger on a single "Incorrect authentication" in the mainlog in exim and BFD is running every 30 seconds, however they are still getting through.

So far over a thousand machines have been blacklisted with the period currently set to a 4 day ban.

Are there any other suggestions as to what can be done?

  • Can you set up a delay for all incoming connections, in the hope the attack bot is not very patient? Similar to what greylisting does. – Dan Feb 21 '15 at 12:55
  • @Dan what would you recommend to achieve this? – Neo Feb 21 '15 at 21:37

Would fail2ban be better than BFD as it runs continuously? Either way, you probably are at least reducing risks of weak passwords being compromised.

Maybe check some of the offending IP addresses against a multi-RBL list like http://multirbl.valli.org and see if something like Project Honeypot would catch them. Of course the RBL check needs to come before SASL authentication.

  • I'll look into fail2ban, both exim and APF are setup to use RBL lists, mainly spamhaus so I doubt an extral RBL would work – Neo Feb 21 '15 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.