smtp block brute force attacks

[tal56]

Hi guys,

I'm getting a lot of smtp brute force attacks lately and on my /var/log/secure logs they don't even list the IP of the person trying the attacks. They look like this :

Jun 19 16:24:27 server1 saslauthd[2048]: pam_unix(smtp:auth): check pass; user unknown
Jun 19 16:24:27 server1 saslauthd[2048]: pam_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Jun 19 16:24:27 server1 saslauthd[2048]: pam_succeed_if(smtp:auth): error retrieving information about user 123456
Jun 19 16:24:29 server1 saslauthd[2047]: pam_unix(smtp:auth): check pass; user unknown
Jun 19 16:24:29 server1 saslauthd[2047]: pam_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Jun 19 16:24:29 server1 saslauthd[2047]: pam_succeed_if(smtp:auth): error retrieving information about user notused
Jun 19 16:24:29 server1 saslauthd[2049]: pam_unix(smtp:auth): check pass; user unknown
Jun 19 16:24:29 server1 saslauthd[2049]: pam_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Jun 19 16:24:29 server1 saslauthd[2049]: pam_succeed_if(smtp:auth): error retrieving information about user Hockey

What's the best way to block these attacks? Thanks

[till]

If you know the IP of the attacker, you might use this command:

/sbin/route add -host 123.123.123.123 reject

[tal56]

Originally Posted by till

If you know the IP of the attacker, you might use this command:

/sbin/route add -host 123.123.123.123 reject

Till, how do I find out the IP? Normally I also see the IP on the log file, but for these there's nothing. Thanks

[hairydog2]

Originally Posted by till

If you know the IP of the attacker, you might use this command:

/sbin/route add -host 123.123.123.123 reject

I tried to do this, but got

SIOCADDRT: No such device

Any suggestions?

[falko]

There seems to be something wrong with one of your network interfaces. Did you try to reboot the server?

[hairydog2]

Originally Posted by falko

There seems to be something wrong with one of your network interfaces. Did you try to reboot the server?

Oddly enough, when I tried again later, it worked!

[falko]

fail2ban:
http://www.howtoforge.com/fail2ban_debian_etch

[tal56]

Is there a fail2ban tutorial for Centos 5?

[falko]

Originally Posted by tal56

Is there a fail2ban tutorial for Centos 5?

Unfortunately no...

[sonoracomm]

Originally Posted by tal56

Is there a fail2ban tutorial for Centos 5?

I saw this post so I put up my notes. It's not a full howto, but it's close.

I run ISPC on Centos 5.2.

http://www.sonoracomm.com/support/18...t/228-fail2ban

G