Shieldlist

mail-auth Free

Mail password guessing — five different passwords in ten minutes on SMTP/IMAP/POP; the way mailboxes get hijacked

Category
mail
Threshold
5/10m
Ban policy
auth
Report
mail-intrusion
Parsers
dovecot-password-mismatch

Why it is written this way

Mail password GUESSING, SMTP and IMAP/POP alike: five DIFFERENT
passwords refused for one address in ten minutes. Dovecot logs a
short hash of every refused password when auth_verbose_passwords is
on — Dovecot does NOT log them by default, on any distribution and
under any panel; it is a line an operator adds. Until it is added
this rule honestly reads 0 hits — mail-balance and mail-spray watch
the door meanwhile). Dovecot authenticates Postfix's SASL too, so one parser sees both
doors. `distinct` is what makes this fair: a phone with a stale
password retries the SAME wrong one every minute — one hash, never a
ban — while a guesser's five attempts are five hashes (CrowdSec's
dovecot-bf: capacity 4, distinct password hash). The ladder starts at
an hour on the mail ports only.

The rule file View raw

# Mail password GUESSING, SMTP and IMAP/POP alike: five DIFFERENT
# passwords refused for one address in ten minutes. Dovecot logs a
# short hash of every refused password when auth_verbose_passwords is
# on — Dovecot does NOT log them by default, on any distribution and
# under any panel; it is a line an operator adds. Until it is added
# this rule honestly reads 0 hits — mail-balance and mail-spray watch
# the door meanwhile). Dovecot authenticates Postfix's SASL too, so one parser sees both
# doors. `distinct` is what makes this fair: a phone with a stale
# password retries the SAME wrong one every minute — one hash, never a
# ban — while a guesser's five attempts are five hashes (CrowdSec's
# dovecot-bf: capacity 4, distinct password hash). The ladder starts at
# an hour on the mail ports only.
rule: mail-auth
description: "Mail password guessing — five different passwords in ten minutes on SMTP/IMAP/POP; the way mailboxes get hijacked"
about:
  purpose: >-
    Stop someone working through passwords on your mailboxes.
  blocks: >-
    Five DIFFERENT passwords refused for one address in ten minutes. Different is what makes it fair: a phone with a stale password retries the same wrong one every minute and is never banned.
  applies_to: >-
    Any machine running Dovecot, alone or authenticating Postfix's SASL — one parser sees both doors.
  requires:
    - >-
      The mail log, declared as `log: mail` — /var/log/mail.log on Debian and Ubuntu, /var/log/maillog on RHEL and its family.
    - >-
      The mail ports declared beside that log, so a ban closes the mail and leaves the websites alone.
    - >-
      Dovecot with `auth_verbose_passwords = sha1:6` in conf.d/10-logging.conf. It is OFF by default everywhere — no distribution and no panel turns it on for you. Until it is on, this rule honestly reads ZERO hits: nothing is broken, there is simply nothing to read, and mail-balance and mail-spray watch the door meanwhile.
  beware:
    - >-
      A shared address — an office, a school, a hotel — can reach five different wrong passwords in ten minutes without anyone attacking you.
category: mail
parsers: dovecot-password-mismatch
threshold: 5/10m
distinct: password_hash
ban: auth
report: mail-intrusion