服务器 Gind.cn
  1. 服务器 Gind.cn
  3. 对SMTP的一个聪明的攻击逃避fail2ban
Intereting Posts
将MBps转换为k / s 重新获得对EC2 EBS引导映像的根访问权限 规划升级到Exchange 2010，但一些旧的Exchange 2000信息仍在AD中 与命名/绑定和转发区域的困境 在Samba服务器上的Windows 7 x64中设置“打印”设置 Django网站与httpd和mod_wsgi：403禁止 在Windows Server 2012 R2中缺lessGPO“允许事件日志中的作业名称” docker适合长期运行的容器吗？ VOIP SIP – 来电呼叫的强连接时间 如何在htaccess中允许访问站点根文件？ Postfix，为托pipe网站设置SMTP Azure：将公共IP映射到VM上的特定端口 是否有可能使用VSS静默ms-access数据库备份？ sendmail不工作在Ubuntu 安装失败的SQL Server群集，Addnode：远程registry调用失败

对SMTP的一个聪明的攻击逃避fail2ban

我以一种逃避典型的fail2ban设置的方式对我的SMTP服务器进行powershell攻击：

  • 攻击来自同一子网中的多个IP
  • 单个IP攻击的时间间隔超过一个小时，显然是为了避免被fail2ban阻塞，fail2ban通常使用findtime和bantime时间短于一个小时

这是日志： 

 2017-09-05 01:11:19 LOGIN authenticator failed for (User) [91.200.12.165]:57519 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=soft) 2017-09-05 01:11:36 LOGIN authenticator failed for (User) [91.200.12.164]:51973 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=sandy) 2017-09-05 01:15:22 LOGIN authenticator failed for (User) [91.200.12.121]:51545 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=brown) 2017-09-05 01:28:57 LOGIN authenticator failed for (User) [91.200.12.105]:64938 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=family) 2017-09-05 01:48:32 LOGIN authenticator failed for (User) [91.200.12.165]:64730 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=soi) 2017-09-05 01:48:47 LOGIN authenticator failed for (User) [91.200.12.164]:59184 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=sanjeev) 2017-09-05 01:50:13 LOGIN authenticator failed for (User) [91.200.12.166]:64999 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=until) 2017-09-05 01:54:05 LOGIN authenticator failed for (User) [91.200.12.121]:58756 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=bryan) 2017-09-05 02:04:34 LOGIN authenticator failed for (User) [91.200.12.105]:55772 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=famous) 2017-09-05 02:25:36 LOGIN authenticator failed for (User) [91.200.12.165]:55563 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=soldiers) 2017-09-05 02:25:48 LOGIN authenticator failed for (User) [91.200.12.164]:50017 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=sanmiguel) 2017-09-05 02:30:33 LOGIN authenticator failed for (User) [91.200.12.166]:55835 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=update) 2017-09-05 02:32:56 LOGIN authenticator failed for (User) [91.200.12.121]:49589 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=bsd) 2017-09-05 02:40:11 LOGIN authenticator failed for (User) [91.200.12.105]:62983 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=far) 2017-09-05 03:02:29 LOGIN authenticator failed for (User) [91.200.12.165]:62775 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=solution) 2017-09-05 03:02:40 LOGIN authenticator failed for (User) [91.200.12.164]:57228 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=santamaria) 2017-09-05 03:10:50 LOGIN authenticator failed for (User) [91.200.12.166]:63046 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=upgrade) 2017-09-05 03:11:37 LOGIN authenticator failed for (User) [91.200.12.121]:56803 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=bubba) 2017-09-05 03:15:41 LOGIN authenticator failed for (User) [91.200.12.105]:53820 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=farias) 2017-09-05 03:39:36 LOGIN authenticator failed for (User) [91.200.12.165]:53612 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=solve) 2017-09-05 03:39:48 LOGIN authenticator failed for (User) [91.200.12.164]:64441 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=santos) 2017-09-05 03:50:50 LOGIN authenticator failed for (User) [91.200.12.121]:64015 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=buchhaltung) 2017-09-05 03:51:30 LOGIN authenticator failed for (User) [91.200.12.166]:53880 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=upload) 2017-09-05 03:51:34 LOGIN authenticator failed for (User) [91.200.12.105]:61032 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=farm) 2017-09-05 04:17:31 LOGIN authenticator failed for (User) [91.200.12.165]:60825 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=somebody) 2017-09-05 04:17:34 LOGIN authenticator failed for (User) [91.200.12.164]:55274 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=sara) 2017-09-05 04:27:43 LOGIN authenticator failed for (User) [91.200.12.105]:51865 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=farmer) 2017-09-05 04:30:06 LOGIN authenticator failed for (User) [91.200.12.121]:54848 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=buddy) 2017-09-05 04:32:02 LOGIN authenticator failed for (User) [91.200.12.166]:61091 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=upon) 2017-09-05 04:55:24 LOGIN authenticator failed for (User) [91.200.12.164]:62485 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=sarah) 2017-09-05 04:55:24 LOGIN authenticator failed for (User) [91.200.12.165]:51657 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=someone) 2017-09-05 05:03:42 LOGIN authenticator failed for (User) [91.200.12.105]:59078 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=farmers) 2017-09-05 05:09:10 LOGIN authenticator failed for (User) [91.200.12.121]:62060 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=build) 2017-09-05 05:12:27 LOGIN authenticator failed for (User) [91.200.12.166]:51923 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=ups) 2017-09-05 05:33:26 LOGIN authenticator failed for (User) [91.200.12.164]:53321 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=sat) 2017-09-05 05:33:26 LOGIN authenticator failed for (User) [91.200.12.165]:58869 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=somethin) 2017-09-05 05:40:00 LOGIN authenticator failed for (User) [91.200.12.105]:49912 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=fast) 2017-09-05 05:48:34 LOGIN authenticator failed for (User) [91.200.12.121]:52896 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=building) 2017-09-05 05:53:00 LOGIN authenticator failed for (User) [91.200.12.166]:59136 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=uranus) 2017-09-05 06:11:20 LOGIN authenticator failed for (User) [91.200.12.165]:49705 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=son) 2017-09-05 06:11:21 LOGIN authenticator failed for (User) [91.200.12.164]:60535 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=saturn) 2017-09-05 06:16:06 LOGIN authenticator failed for (User) [91.200.12.105]:57124 I=[192.168.1.224]:25: 535 Incorrect authentication data (set_id=father

有没有办法做出某种有select性的fail2ban设置，这种攻击的方式不仅仅是将findtime和bantime增加到几个小时？

有没有办法做出某种有select性的fail2ban设置，这种攻击的方式不仅仅是将findtime和bantime增加到几个小时？

您可以使用正则expression式创build额外的规则，只匹配这些客户端，具有更高的findtime。 使用额外的规则不会影响你的其他规则工作正常。

请注意，您最终不会创build可能由正常login失败触发的规则。 这取决于您可能有多less用户使用同一个ISP，因此从同一个子网连接，有时会提供错误的凭据。

Fail2Ban可以自动防止典型的powershell攻击。 来自更广泛子网的这种恶意活动并不是那么平常，而且可以手动处理：

  1. 如果您不需要从91.200.12.0/22获得91.200.12.0/22身份validation的SMTP， 91.200.12.0/22阻止在防火墙上。

    如果您在端口587上单独提交了经过身份validation的SMTP，并且从不允许在端口25上进行身份validation，则这可能会更容易; 这将阻止提供有关SMTPlogin25任何信息，并仍然允许从91.200.12.0/22可能的合法传入的邮件。

  2. 如果你认为这个networking被劫持，那么whois数据库有联系信息。 通过联系这个IP块的所有者，你可以帮助他们解决实际的问题！ 

     inetnum: 91.200.12.0 - 91.200.15.255 remarks: **********************************Attention*************** remarks: The pool is used other Department! remarks: In case of questions related to SPAM, HACKING, SECURITY remarks: Please contact directly [email protected] remarks: tel: +38 (044) 379-28-50; +7 (499) 404-16-45 remarks: **********************************************************