mail-auth-abort Gratuit

SMTP sessions that ask for AUTH and hang up — reconnaissance for credential attacks on mailboxes, seen from whole botnets at once

Catégorie

mail

Seuil

2/24h, 4/7d

Politique de ban

attack

Signalement

mail-auth-probe

Parseurs

postfix-auth-abort postfix-auth-ok

Pourquoi elle est écrite ainsi

Le fichier de la règle Voir le brut

# Asking whether this server offers SMTP authentication, and leaving —
# "lost connection after AUTH". A customer's client that loses its
# network does it once in a while; a machine sweeping for a server that
# will carry its mail does it on every server it finds. Two in a day.
# Whoever actually sends an authenticated message is a customer and is
# forgiven ten times over: nobody fakes that line, it takes the password.
rule: mail-auth-abort
description: "SMTP sessions that ask for AUTH and hang up — reconnaissance for credential attacks on mailboxes, seen from whole botnets at once"
about:
  purpose: >-
    Catch a machine sweeping for a mail server that will carry its mail — asking whether you offer authentication, then leaving.
  blocks: >-
    Two connections lost right after AUTH in a day, four in a week.
  applies_to: >-
    Any machine running Postfix.
  requires:
    - >-
      The mail log, declared as `log: mail` — /var/log/mail.log on Debian and Ubuntu, /var/log/maillog on RHEL and its family.
    - >-
      The mail ports declared beside that log, so a ban closes the mail and leaves the websites alone.
  beware:
    - >-
      A customer's client that loses its network does this once in a while. Whoever actually sends an authenticated message is forgiven ten times over — nobody fakes that line, it takes the password.
category: mail
parsers:
  - postfix-auth-abort
  - parser: postfix-auth-ok
    weight: -10
threshold: [2/24h, 4/7d]
ban: attack
report: mail-auth-probe