0

In my /usr/local/psa/var/log/maillog on my Plesk VPS I get the same set of log messages around every three minutes. I've reproduced an example of them below (my vps name has been changed).

Apr  3 18:11:26 myvps postfix/smtpd[12561]: warning: hostname vps863.hidehost.net does not resolve to address 91.200.12.150: Name or service not known
Apr  3 18:11:26 myvps postfix/smtpd[12561]: connect from unknown[91.200.12.150]
Apr  3 18:11:26 myvps plesk_saslauthd[12563]: listen=6, status=5, dbpath='/plesk/passwd.db', keypath='/plesk/passwd_db_key', chroot=1, unprivileged=1
Apr  3 18:11:26 myvps plesk_saslauthd[12563]: privileges set to (103:113) (effective 103:113)
Apr  3 18:11:26 myvps plesk_saslauthd[12563]: failed mail authenticatication attempt for user 'auditor' (password len=9)
Apr  3 18:11:26 myvps postfix/smtpd[12561]: warning: unknown[91.200.12.150]: SASL LOGIN authentication failed: authentication failure
Apr  3 18:11:26 myvps postfix/smtpd[12561]: lost connection after AUTH from unknown[91.200.12.150]
Apr  3 18:11:26 myvps postfix/smtpd[12561]: disconnect from unknown[91.200.12.150]
Apr  3 18:11:56 myvps plesk_saslauthd[12563]: select timeout, exiting

What are they trying to do here? And does this indicate there's something wrong with my security configuration or is just normal evidence of hacking attempts?

  • They are called "drive by"; and it's as normal as weather on any permanent server address. – dandavis Apr 3 '17 at 17:52
  • Ah yes, but I'm interested specifically in how the hacking attempt would work. Is the aim to be able to access inboxes / send spam email using my server? – Collierre Apr 3 '17 at 18:10
  • i'm not psychic, but i think that's a reasonable explanation of their efforts. – dandavis Apr 3 '17 at 18:13
3

To quickly run through the log lines, anything with postfix/ in it relates to your SMTP server (the server responsible for sending/receiving email, where e.g. IMAP presents email to users).

The other lines, relating to plesk_saslauthd, are from your authentication backend for postfix.

So:

Apr  3 18:11:26 myvps postfix/smtpd[12561]: warning: hostname vps863.hidehost.net does not resolve to address 91.200.12.150: Name or service not known
Apr  3 18:11:26 myvps postfix/smtpd[12561]: connect from unknown[91.200.12.150]

A connection to postfix (presumably on tcp/25) was made by a server at 91.200.12.150 (which doesn't have a proper A/PTR pair, and claims to be part of hidehost.net)

Apr  3 18:11:26 myvps plesk_saslauthd[12563]: listen=6, status=5, dbpath='/plesk/passwd.db', keypath='/plesk/passwd_db_key', chroot=1, unprivileged=1
Apr  3 18:11:26 myvps plesk_saslauthd[12563]: privileges set to (103:113) (effective 103:113)
Apr  3 18:11:26 myvps plesk_saslauthd[12563]: failed mail authenticatication attempt for user 'auditor' (password len=9)

That connection attempt was followed by an attempt to login as user auditor, and after plesk_saslauthd spawned a process to deal with it, that attempt failed.

Apr  3 18:11:26 myvps postfix/smtpd[12561]: warning: unknown[91.200.12.150]: SASL LOGIN authentication failed: authentication failure
Apr  3 18:11:26 myvps postfix/smtpd[12561]: lost connection after AUTH from unknown[91.200.12.150]
Apr  3 18:11:26 myvps postfix/smtpd[12561]: disconnect from unknown[91.200.12.150]

Postfix is told this user failed to authenticate, reports as much to the 'client', and the client disconnects.

Apr  3 18:11:56 myvps plesk_saslauthd[12563]: select timeout, exiting

The process used to check the credentials supplied during the connection exits.

The main things you should be concerned about are:

  • not allowing any important accounts to be bruteforced by repeated, unlimited attempts
  • ensuring insofar as possible users choose good passwords.

As for your other concerns, there isn't enough log to say if your service can be abused.

As @dandavis mentions, this happens all the time, so making sure you have followed any applicable best practices (OS, Plesk, and individual services) is probably a good thing.

  • Love your point to point description. I was getting so many of these message in my log. Someone trying very hard to get in by using different users, for my case: sales, temp, vpn, xerox, abuse etc. every 5 or 15 minutes in an hour. Thank you for explaining. – Anil Jul 20 '17 at 2:14
0

I too have had this problem for some time, and there does not appear to be a clear answer to stopping them comunicating with the Mail server.

What I have found though that works really well is setting you Static Routes in your LAN option. Using the Failed SASL attempt address, followed by the 255.255.255.255 subnet mask and pointing to YOUR Router Gateway address, example: 192.168.1.1 and a metric of 2.

This literally stops them even communicating with the mail server and sends them back out the door. (Loop)

I find it 100% effective with this type of intrusion, unfortunately my ASUS Router only allows for a max. 10 Static Routes. It instantly reduces these logs by 90% once they are entered. I make a point of reviewing them at least weekly, remove some older ones and apply any newer addresses that are being utilized. It is a little bit of effort and management but not hard and very satisfying to see instant KAMA results.

  • You might find that fail2ban offers an automated, immediate and more hands-off method of blocking and reducing brute-force attempts. No static routes required, it automatically monitors logs for evidence of brute-force attempts and extends the server's own firewall rules in configurable ways. – Johnny Nov 5 '18 at 7:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.