mail-spray Free

Failed logins spread across six different mailboxes from one address — password spraying, not a forgotten password

Category

mail

Threshold

6/10m

Ban policy

auth

Report

mail-intrusion

Parsers

dovecot-auth-fail postfix-sasl-fail

Why it is written this way

The rule file View raw

# Password spraying: failed logins on six DIFFERENT mailboxes from one
# address in ten minutes. A person has one or two mailboxes; a list has
# hundreds. Distinct on the mailbox named, so a single stale account
# retried all day is one (CrowdSec's dovecot-spray: capacity 5,
# distinct user).
rule: mail-spray
description: "Failed logins spread across six different mailboxes from one address — password spraying, not a forgotten password"
about:
  purpose: >-
    Catch password spraying — one password tried against mailbox after mailbox.
  blocks: >-
    Failed logins on six DIFFERENT mailboxes from one address in ten minutes. A person has one or two mailboxes; a list has hundreds.
  applies_to: >-
    Any machine running Dovecot or Postfix SASL — the mailbox named is read on both doors.
  requires:
    - >-
      The mail log, declared as `log: mail` — /var/log/mail.log on Debian and Ubuntu, /var/log/maillog on RHEL and its family.
    - >-
      The mail ports declared beside that log, so a ban closes the mail and leaves the websites alone.
  beware:
    - >-
      Distinct is on the mailbox named, so a single stale account retried all day counts once. A mail gateway that authenticates for many of your users would look like a sprayer: exempt it.
category: mail
parsers:
  - dovecot-auth-fail
  - postfix-sasl-fail
threshold: 6/10m
distinct: user
ban: auth
report: mail-intrusion