Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #269427 > unrolled thread

Knocking on the door

Back to article view | Back to linux.debian.user

Contents

  Knocking on the door Maurizio Caloro <maurizio@caloro.ch> - 2024-05-17 16:00 +0200
    Re: Knocking on the door Charles Curley <charlescurley@charlescurley.com> - 2024-05-17 18:50 +0200
      AW: Knocking on the door "Maurizio Caloro" <maurizio@caloro.ch> - 2024-05-18 15:30 +0200

#269427 — Knocking on the door

[Converted from HTML] — view raw

 

Hello



Please i know that this arn't the Dovecot forum, but let me try, on the
log's i have always knocking "unknown user" attempts.



> May 15 22:39:31 Dovecot/auth-worker(2602036): Info: conn unix:auth-worker
(pid=2602030,uid=113): auth-worker<49>:sql([bin@domain.ch,194.169.175.10][1]):
unknown user



yes i try with fail2ban, but i didn't see or found the right regex, so that
this will be blocked please has any from you solve this knocking task?



thanks

 



Von meinem iPhone gesendet

[1]: mailto:bin@domain.ch,194.169.175.10

[toc] | [next] | [standalone]

#269430

On Fri, 17 May 2024 15:49:52 +0200
Maurizio Caloro <maurizio@caloro.ch> wrote:

>  
> 
> Hello
> 
> 
> Please i know that this arn't the Dovecot forum, but let me try, on
> the log's i have always knocking "unknown user" attempts.
> 
> 
> > May 15 22:39:31 Dovecot/auth-worker(2602036): Info: conn
> > unix:auth-worker (pid=2602030,uid=113):
> > auth-worker<49>:sql(bin@domain.ch,194.169.175.10): unknown user

I only see one record here. fail2ban requires multiple attempts within
a certain period before it will ban the source address. 


> 
> 
> yes i try with fail2ban, but i didn't see or found the right regex,
> so that this will be blocked please has any from you solve this
> knocking task?

Are you sure you want to worry about it? dovecot seems to be doing its
job by refusing access to unknown users.

If you see repeated attempts from the same source, you might want to
craft a firewall rule to ban that source (or than network).

Show us the files you have modified so we can see what you are doing.

> 
> 
> thanks
> 
>  
> 
> 
> Von meinem iPhone gesendet
> 



-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [next] | [standalone]

#269449 — AW: Knocking on the door

Hello
Thanks for reply yes, i have put now this, I have peace now 😊

#cat postfix-addon.conf
[INCLUDES]
before = common.conf

[Definition]
_daemon = postfix/smtpd

failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.2\.1 .*$
^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.6\.1 : Helo       command rejected: Host not found; to=<> from=<> bcc=<> Yproto=ESMTP helo= *$
	^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.4\.1 .*$
	^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 454 4\.7\.2 :*$
	reject: RCPT from (.*)\[<HOST>\]: 550 5.2.1
	reject: RCPT from (.*)\[<HOST>\]: 450 4.6.1
	reject: RCPT from (.*)\[<HOST>\]: 554 5.4.1
	reject: RCPT from unknown\[<HOST>\]: 454 4.7.2
	connect from unknown\[<HOST>\]
ignoreregex =

--
you cannot fail unless you quit!

-----Ursprüngliche Nachricht-----
Von: Charles Curley <charlescurley@charlescurley.com> 
Gesendet: Freitag, 17. Mai 2024 18:45
An: Debian Users <debian-user@lists.debian.org>
Betreff: Re: Knocking on the door

On Fri, 17 May 2024 15:49:52 +0200
Maurizio Caloro <maurizio@caloro.ch> wrote:

> 
> Hello
> 
> 
> Please i know that this arn't the Dovecot forum, but let me try, on 
> the log's i have always knocking "unknown user" attempts.
> 
> 
> > May 15 22:39:31 Dovecot/auth-worker(2602036): Info: conn 
> > unix:auth-worker (pid=2602030,uid=113):
> > auth-worker<49>:sql(bin@domain.ch,194.169.175.10): unknown user

I only see one record here. fail2ban requires multiple attempts within a certain period before it will ban the source address. 


> 
> 
> yes i try with fail2ban, but i didn't see or found the right regex, so 
> that this will be blocked please has any from you solve this knocking 
> task?

Are you sure you want to worry about it? dovecot seems to be doing its job by refusing access to unknown users.

If you see repeated attempts from the same source, you might want to craft a firewall rule to ban that source (or than network).

Show us the files you have modified so we can see what you are doing.

> 
> 
> thanks
>
--
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web