0

I supply email accounts to customers. Occasionally some customers are blocked by our firewall (CSF) if they get the usernames or password wrong. But sometimes they get blocked because their IP address was determines to be port scanning the mail server. The log message would be:

Temporary Blocks: IP:123.123.123.123 Port: Dir:in TTL:3600 (lfd - *Port Scan* detected from 123.123.123.123 (GB/United Kingdom/-). 21 hits in the last 261 seconds)

Because they are not hackers, just a normal business office, one possibility is a computer has a virus and is trying to connect to the mail server, perhaps it obtained the mail server settings from Apple Mail. But I doubt this to be the case.

So does anyone know what other software could be performing port scans on the Apple Mail mail server? Apple Mail itself? We would need to stop these "scans".

Edit: Just found out its all Macs and Apple Mail in the office, not Outlook. And they have a temporary EE (mobile provider) box to connect to the internet because BT are taking ages to sort their internet out. Have updated question above.

Edit: The customer was connecting to port 585 very often and were being blocked. This port is not open in our firewall. But it seems port 585 is indeed an IMAP port, and various websites state Apple Mail uses it. So I have had to open this port due to Apple Mail using it.

Edit: See accepted answer, but instead of opening the port, I added it to DROP_NOLOG in the CSF settings. Accepted answer shows how to do that using iptables command if not using CSF.

  • 1
    Do you know what ports are beings scanned or is this log all the information you have? There is a good chance that this is a false positive. Is all the traffic coming from internal IP’s? If so you can check them for viruses easy enough. There is a possibility that the box that is being flagged as scanning has been compromised and someone is using it to pivot around the network. There is no enough information to say with any certainty if that is likely however. – TheJulyPlot Jul 7 '17 at 11:50
  • 1
    Is it there are two many client connections to your server from the one IP. The log detected 21 hits. Is it possible it's seeing this as a scan when in fact it is not. Do you know what ports are being 'hit'? Do the clients have different access ports such as 433,25,110,995,465,587 etc? This may appear as a scan from the firewalls perspective. – ISMSDEV Jul 7 '17 at 12:13
  • First step: understand what the system defines as a "port scan" - the answer might reveal itself from that detail alone. – schroeder Jul 7 '17 at 12:30
  • Thanks for comments. Will look into it all now. but just made a correction on the question, its all Apple Macs with Apple Mail, not Outlook! – Laurence Cope Jul 11 '17 at 15:34
4

The CSF log message you provided states that it found "21 hits in the last 261 seconds." So the question is, what was hitting? The CSF configuration file describes their port scan detector as follows:

###############################################################################
# SECTION:Port Scan Tracking
###############################################################################
# Port Scan Tracking. This feature tracks port blocks logged by iptables to
# syslog. If an IP address generates a port block that is logged more than
# PS_LIMIT within PS_INTERVAL seconds, the IP address will be blocked.
...
# This feature blocks all iptables blocks from the iptables logs, including
# repeated attempts to one port or SYN flood blocks, etc

So, your iptables configuration is blocking individual connections from your customers, and CSF watches the iptables logs and reacts when it sees too many individual block log entries. Since it is using your iptables logs as its raw data point, the same raw data must be there for you to review.

So what you need to do is review your iptables logs for the time period in question and see what port they were reaching for that was being blocked. If it was 465/tcp or 587/tcp, for example, that might indicate their mail client is trying secure alternate ports first before going to 25/tcp for SMTP. That implies a sort of legitimate false positive, and you might compensate by configuring iptables to block without logging on those two ports.

If, on the other hand, they're trying a broad array of ports which aren't mail related, (21/tcp, 22/tcp, 23/tcp, 139/tcp, 161/udp, 445/tcp, ...) then someone or something there is truly portscanning you.


Based on the comment below, your logs state that connections on port 585 are triggering the blocks. Port 585/tcp is associated with Apple email clients. You could ask the user to fix their email client, but since it's an Apple client, all the online mentions of this say it's hard to figure out how to do that. So you can instead adjust your firewall rules to not log this traffic. If you look at your IPtables INPUT chain, you'll see the last two lines are probably LOG and DROP:

# iptables -L INPUT -n --line-numbers
Chain INPUT (policy DROP)
num  target     prot opt source               destination
...
20   LOG        all  --  0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4
21   DROP       all  --  0.0.0.0/0            0.0.0.0/0

You can then INSERT a new and specific DROP rule at the location of the current LOG rule:

# iptables -I INPUT 20 -p tcp --dport 585 -j DROP
# iptables -L -n --line-numbers
Chain INPUT (policy DROP)
num  target     prot opt source               destination
...
20   DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:585
21   LOG        all  --  0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4
22   DROP       all  --  0.0.0.0/0            0.0.0.0/0

and now the port 585 connections will DROP before they would be LOGged, and your CSF tool will no longer react to these connection attempts (but they will still be blocked!).

  • There are a lot of blocks in the logs form the customer IP for port 585. Interestingly I can see other posts online from users saying port 585 was being connected to and using Apple Mail. Looking into it further. Maybe a port number typo. ---- Jul 11 14:26:51 mail kernel: Firewall: TCP_IN Blocked IN=eth0 OUT= MAC=xxxxxxxxxxxxxxx SRC=123.456.789 DST=123.456.789 LEN=64 TOS=0x00 PREC=0x00 TTL=52 ID=39058 DF PROTO=TCP SPT=65066 DPT=585 WINDOW=65535 RES=0x00 SYN URGP=0 – Laurence Cope Jul 11 '17 at 15:52
  • Seems port 585 is indeed an IMAP port, and various websites state Apple Mail uses it – Laurence Cope Jul 11 '17 at 16:07
  • I believe it's IMAP (143/tcp), IMAP+STARTTLS (585/tcp), and TLS+IMAP (993/tcp). 585 is unusual because for IMAP people who wanted encryption generally jumped to TLS+IMAP rather than STARTTLS... answer updated to reflect recommended fix. – gowenfawr Jul 11 '17 at 16:23
  • Thanks a lot. I have now unblocked it but added it to DROP. In the CSF config, I think its the DROP_NOLOG settings, so added it to there. I can see it added to iptables now: DROP tcp -- anywhere anywhere tcp dpt:585 DROP udp -- anywhere anywhere udp dpt:585 – Laurence Cope Jul 12 '17 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.