2

This is the today exim reject log:

2016-01-07 13:48:44 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 15:32:09 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 15:41:35 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 15:49:01 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 15:56:50 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 16:04:58 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 16:12:28 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 16:20:19 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 16:28:08 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 16:35:50 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 16:43:28 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 16:51:18 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 16:58:51 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 17:06:25 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 17:13:58 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 17:21:29 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 17:28:52 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 17:36:18 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 17:43:43 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 17:51:46 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 17:59:08 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 18:06:44 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 18:14:10 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 18:21:39 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 18:29:02 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 18:36:36 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 18:44:00 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 18:51:21 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 18:58:40 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 19:05:59 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 19:13:18 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 19:20:42 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 19:28:03 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 19:35:48 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 19:43:11 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 19:50:35 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 19:57:59 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 20:05:25 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 20:12:51 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 20:20:17 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 20:27:41 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])
2016-01-07 20:35:06 login authenticator failed for (USER) [212.224.87.119]: 535 Incorrect authentication data ([email protected])

I don't want to wait and do nothing more, is it possibile to create a blacklist for exim populated with ip addresses of more then 10 login attemps in 1h?

Mind that I want to creare a blacklist for smtp login attemps and not for email senders.

Improve this question
3
  • Would fail2ban do what you want? This can automatically block connections from repeat offenders (using iptables or similar).
    – Paul Haldane
    Jan 7, 2016 at 21:48
  • Maybe, but I cannot understand if it can check for multiple logs (exim, apache, dovecot etc.).
    – Tobia
    Jan 7, 2016 at 22:10
  • Otherwise can I configure exim to log to a mysql table all login failed attempts?
    – Tobia
    Jan 7, 2016 at 22:11

1 Answer 1

Reset to default
2

It looks like a poorly done hacking attempt. I've seen a few of them.

I would recommend using fail2ban to block the IP on multiple failures. You should verify the patterns as the default patterns don't always match. It handles multiple files and multiple services.

Exim does have the ability to ratelimit traffic. There are two versions and the newer version is designed to be used in ACLs. This will only slow down people trying to crack your password, but it may encourage them to try a different server. If you set the rate too low you may cause problems for legitimate users.

You could also limit auth to the Submission port. A line in the mail section like this should require both TLS encryption and the submission port before authentication is offered. 

auth_advertise_hosts = ${if and 
                     {eq {$tls_cipher}{}{}{*}}
                     {eq {$interface_port}{587}} }
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .