I’m victim of a botnet conducting a brute force SASL attack op my mail server for more than three weeks now. As I use strong passwords on my mailboxes, all attempts have failed so far and fail2ban is doing a great job … so far. But I don’t trust it.

Any advice on how to stop this uncomfortable situation?
Here are some Netfilter logs showing the attack:

01/11/2024, 02:17:29 PM warn 101.69.242.122 matched rule id 3 (warning: unknown[101.69.242.122]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=marketing)
01/12/2024, 03:37:53 PM warn 102.35.42.242 matched rule id 3 (warning: unknown[102.35.42.242]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 06:22:48 AM warn 102.38.3.164 matched rule id 3 (warning: unknown[102.38.3.164]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/11/2024, 08:20:25 PM warn 103.126.31.21 matched rule id 3 (warning: unknown[103.126.31.21]: SASL PLAIN authentication failed: (reason unavailable), sasl_username=lucas@dooms.eu)
01/12/2024, 11:35:13 AM warn 103.26.51.88 matched rule id 3 (warning: unknown[103.26.51.88]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=director@dooms.eu)
01/11/2024, 11:50:02 AM warn 104.168.34.166 matched rule id 3 (warning: unknown[104.168.34.166]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=luc@dooms.eu)
01/11/2024, 06:14:12 PM warn 104.168.34.168 matched rule id 3 (warning: unknown[104.168.34.168]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 11:33:44 AM warn 104.168.34.178 matched rule id 3 (warning: unknown[104.168.34.178]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 11:32:33 AM warn 104.168.34.178 matched rule id 3 (warning: unknown[104.168.34.178]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 11:31:33 AM warn 104.168.34.178 matched rule id 3 (warning: unknown[104.168.34.178]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 08:20:27 AM warn 105.73.197.117 matched rule id 3 (warning: unknown[105.73.197.117]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 05:37:34 AM warn 106.117.11.121 matched rule id 3 (warning: unknown[106.117.11.121]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 01:25:50 PM warn 107.172.44.144 matched rule id 3 (warning: unknown[107.172.44.144]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 01:25:11 PM warn 107.172.44.144 matched rule id 3 (warning: unknown[107.172.44.144]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 01:22:45 PM warn 107.172.44.144 matched rule id 3 (warning: unknown[107.172.44.144]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 11:17:10 AM warn 107.172.44.144 matched rule id 3 (warning: unknown[107.172.44.144]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 09:40:10 AM warn 107.172.44.144 matched rule id 3 (warning: unknown[107.172.44.144]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 07:52:46 AM warn 110.17.162.58 matched rule id 3 (warning: unknown[110.17.162.58]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/12/2024, 05:37:16 AM warn 110.17.162.58 matched rule id 3 (warning: unknown[110.17.162.58]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/12/2024, 08:48:36 AM warn 110.249.178.166 matched rule id 3 (warning: unknown[110.249.178.166]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/11/2024, 10:43:16 PM warn 110.49.145.41 matched rule id 3 (warning: unknown[110.49.145.41]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 12:45:08 AM warn 110.7.52.183 matched rule id 3 (warning: unknown[110.7.52.183]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 12:54:06 PM warn 111.39.46.47 matched rule id 3 (warning: unknown[111.39.46.47]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=marketing@dooms.eu)
01/11/2024, 01:55:59 PM warn 111.50.158.56 matched rule id 3 (warning: unknown[111.50.158.56]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/12/2024, 03:21:09 AM warn 111.50.168.9 matched rule id 3 (warning: unknown[111.50.168.9]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/11/2024, 01:21:10 PM warn 111.70.3.4 matched rule id 3 (warning: 111-70-3-4.emome-ip.hinet.net[111.70.3.4]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=marketing@dooms.eu)
01/12/2024, 08:20:41 AM warn 111.92.109.248 matched rule id 3 (warning: unknown[111.92.109.248]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 11:42:59 PM warn 112.94.5.43 matched rule id 3 (warning: unknown[112.94.5.43]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 07:19:24 PM warn 113.160.171.27 matched rule id 3 (warning: unknown[113.160.171.27]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 02:16:56 PM warn 113.160.171.27 matched rule id 3 (warning: unknown[113.160.171.27]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=marketing@dooms.eu)
01/12/2024, 04:28:53 PM warn 113.160.178.187 matched rule id 3 (warning: unknown[113.160.178.187]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 06:18:44 AM warn 113.160.203.137 matched rule id 3 (warning: unknown[113.160.203.137]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 01:28:19 AM warn 113.175.240.33 matched rule id 3 (warning: unknown[113.175.240.33]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 11:11:11 PM warn 114.104.153.51 matched rule id 3 (warning: unknown[114.104.153.51]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/12/2024, 04:38:44 PM warn 114.104.153.51 matched rule id 3 (warning: unknown[114.104.153.51]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 04:46:52 AM warn 114.104.158.172 matched rule id 3 (warning: unknown[114.104.158.172]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/12/2024, 05:37:04 AM warn 114.104.158.172 matched rule id 3 (warning: unknown[114.104.158.172]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 04:26:42 PM warn 114.104.162.36 matched rule id 3 (warning: unknown[114.104.162.36]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 10:09:31 PM warn 115.23.23.90 matched rule id 3 (warning: unknown[115.23.23.90]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 12:04:25 AM warn 115.238.191.246 matched rule id 3 (warning: unknown[115.238.191.246]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/11/2024, 12:55:14 PM warn 115.238.94.18 matched rule id 3 (warning: unknown[115.238.94.18]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/12/2024, 10:41:35 AM warn 116.11.221.87 matched rule id 3 (warning: unknown[116.11.221.87]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=director)
01/11/2024, 09:33:59 PM warn 116.113.124.98 matched rule id 3 (warning: unknown[116.113.124.98]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 05:27:22 PM warn 116.236.142.18 matched rule id 3 (warning: unknown[116.236.142.18]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/11/2024, 10:44:28 PM warn 117.203.175.185 matched rule id 3 (warning: unknown[117.203.175.185]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 06:52:45 AM warn 117.248.104.92 matched rule id 3 (warning: unknown[117.248.104.92]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 05:21:03 PM warn 117.32.102.90 matched rule id 3 (warning: unknown[117.32.102.90]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 01:33:34 AM warn 117.32.132.170 matched rule id 3 (warning: unknown[117.32.132.170]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 10:27:22 AM warn 117.32.98.98 matched rule id 3 (warning: unknown[117.32.98.98]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 11:39:17 AM warn 117.4.201.6 matched rule id 3 (warning: unknown[117.4.201.6]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)

    You call one try every hour as brute force?
    Welcome to the internet, this is normal when you run mail servers.
    As long as you have patched your mailcow to latest release, and use safe passwords (and 2FA) nothing will happen.

    [unknown] But I don’t trust it.

    Why?

    Have something to say?

    Join the community by quickly registering to participate in this discussion. We'd like to see you joining our great moo-community!

    2 months later

    LukeDooms

    For those interested you could just do this –

    docker-compose logs netfilter-mailcow | grep ‘SASL LOGIN authentication failed’ | grep -E -o “([0-9]{1,3}[.]){3}[0-9]{1,3}” |sort -u

    Then pipe to file or cut and paste to a firewall. I’d add a grep -v for your local ips so you don’t block them.

    This will create an enormous list, that will eventually slow down your firewall. Some of these ips are just random dhcp and sooner or later you’ll be blocking legit ips.

    Just my one log –>

    /opt/mailcow-dockerized# docker-compose logs netfilter-mailcow | grep ‘SASL LOGIN authentication failed’ | grep -E -o “([0-9]{1,3}[.]){3}[0-9]{1,3}” |wc
    3102 3102 44569

    I’m not interested in blocking 3k ips. . If you have a small number of email users, I would just lower your fail2ban parameters and double check your email throttle.

      Waw, thanks man. This is really useful.

        6 days later

        LukeDooms you can achieve the same result by setting F2B to blacklist an IP after a single failed attempt, but as pointed out the only thing you will achieve is a massive and ever growing list of IPs that, in the end, will slow down your mail server (and everything else behind that same firewall) with no added benefit.
        as @esackbauer pointed out you should rather look at having proper policies for the password and enforce 2FA whenever possible.
        Everything else is just standard noise you’ll learn to ignore.
        IMHO

          No one is typing