I'm using ufw on a debian server and apparently an attacker is able to circumvent the filtering rules. ufw uses iptables.
The server host http and mail services, and has an ssh port. I use a non-standard port for my ssh and imaps services. I have no login attempts on ssh, but continuous login attempts on imaps. Changing the imaps port didn’t help. In a matter of hours, I get new login attempts.
login attempts go by pairs from apparently random IP addresses, but most frequently from 2 IP addresses in the 185.211.245.128/25
network. I suspect, it's the home base of the attacker.
The first weird thing I noticed was that if I put a deny (DROP) rule after the allow (ACCEPT) rules for ssh, http, mail, but just in front of the allow rule of my imaps server, the deny rules had no effect. For instance, I had a deny rule for 185.211.245.128/25
, but I still saw login attempts from a host in that network. Once I moved the deny rule in front of all allow rules, the login attempts where successfully rejected by the rules.
Since I still got login attempts from random IP addresses (4 to 6 per day), I decided to deny all connection to my imaps server, and only allow IP where I have clients.
To my surprise, I still have login attempts from random IPs. The iptables rules are circumvented.
Here is a copy of the ufw rules some IP hidden:
# ufw status Status: active To Action From -- ------ ---- Anywhere DENY 77.252.26.62 Anywhere DENY 188.162.43.53 Anywhere DENY 77.40.52.94 Anywhere DENY 186.206.168.111 Anywhere DENY 77.40.62.199 Anywhere DENY 103.242.117.49 Anywhere DENY 138.121.244.253 Anywhere DENY 77.40.2.180 Anywhere DENY 77.243.24.0/22 Anywhere DENY 181.112.204.100 Anywhere DENY 202.129.0.42 Anywhere DENY 141.98.80.0/24 Anywhere DENY 185.211.245.128/25 712/tcp ALLOW xxx.xxx.xxx.xxx 712/tcp ALLOW xxx.xxx.0.0/16 712/tcp ALLOW xxx.xxx.xxx.0/21 732/tcp ALLOW Anywhere 80/tcp ALLOW Anywhere 443/tcp ALLOW Anywhere 25/tcp ALLOW Anywhere 465/tcp ALLOW Anywhere 732/tcp ALLOW Anywhere (v6) 80/tcp ALLOW Anywhere (v6) 443/tcp ALLOW Anywhere (v6) 25/tcp ALLOW Anywhere (v6) 465/tcp ALLOW Anywhere (v6)
The imaps is listening on port 712.
Here is the full content of my iptables obtained with iptables -nvL
.
Chain INPUT (policy DROP 2912 packets, 156K bytes) pkts bytes target prot opt in out source destination 37202 6116K fail2ban-dovecot tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,587,143,220,993,110,995,712 3603 3539K fail2ban-sasl tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,587,143,220,993,110,995 3574 3537K fail2ban-postfix tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,587 771 41088 fail2ban-nginx-http-auth tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443 6304 2096K fail2ban-ssh tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 732 112K 26M ufw-before-logging-input all -- * * 0.0.0.0/0 0.0.0.0/0 112K 26M ufw-before-input all -- * * 0.0.0.0/0 0.0.0.0/0 3025 162K ufw-after-input all -- * * 0.0.0.0/0 0.0.0.0/0 2939 157K ufw-after-logging-input all -- * * 0.0.0.0/0 0.0.0.0/0 2939 157K ufw-reject-input all -- * * 0.0.0.0/0 0.0.0.0/0 2939 157K ufw-track-input all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ufw-before-logging-forward all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ufw-before-forward all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ufw-after-forward all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ufw-after-logging-forward all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ufw-reject-forward all -- * * 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 2 packets, 170 bytes) pkts bytes target prot opt in out source destination 108K 50M ufw-before-logging-output all -- * * 0.0.0.0/0 0.0.0.0/0 108K 50M ufw-before-output all -- * * 0.0.0.0/0 0.0.0.0/0 21567 2683K ufw-after-output all -- * * 0.0.0.0/0 0.0.0.0/0 21567 2683K ufw-after-logging-output all -- * * 0.0.0.0/0 0.0.0.0/0 21567 2683K ufw-reject-output all -- * * 0.0.0.0/0 0.0.0.0/0 21567 2683K ufw-track-output all -- * * 0.0.0.0/0 0.0.0.0/0 Chain fail2ban-dovecot (1 references) pkts bytes target prot opt in out source destination 37202 6116K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 Chain fail2ban-nginx-http-auth (1 references) pkts bytes target prot opt in out source destination 771 41088 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 Chain fail2ban-postfix (1 references) pkts bytes target prot opt in out source destination 3574 3537K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 Chain fail2ban-sasl (1 references) pkts bytes target prot opt in out source destination 3603 3539K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 Chain fail2ban-ssh (1 references) pkts bytes target prot opt in out source destination 6279 2094K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 Chain ufw-after-forward (1 references) pkts bytes target prot opt in out source destination Chain ufw-after-input (1 references) pkts bytes target prot opt in out source destination 8 624 ufw-skip-to-policy-input udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:137 0 0 ufw-skip-to-policy-input udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:138 6 280 ufw-skip-to-policy-input tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:139 72 3380 ufw-skip-to-policy-input tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:445 0 0 ufw-skip-to-policy-input udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:67 0 0 ufw-skip-to-policy-input udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:68 0 0 ufw-skip-to-policy-input all -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type BROADCAST Chain ufw-after-logging-forward (1 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] " Chain ufw-after-logging-input (1 references) pkts bytes target prot opt in out source destination 2625 128K LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] " Chain ufw-after-logging-output (1 references) pkts bytes target prot opt in out source destination Chain ufw-after-output (1 references) pkts bytes target prot opt in out source destination Chain ufw-before-forward (1 references) pkts bytes target prot opt in out source destination 0 0 ufw-user-forward all -- * * 0.0.0.0/0 0.0.0.0/0 Chain ufw-before-input (1 references) pkts bytes target prot opt in out source destination 27445 12M ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 61175 13M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 299 12524 ufw-logging-deny all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 299 12524 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 3 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 4 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 11 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 12 18532 645K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8 66 22448 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68 4507 244K ufw-not-local all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT udp -- * * 0.0.0.0/0 224.0.0.251 udp dpt:5353 0 0 ACCEPT udp -- * * 0.0.0.0/0 239.255.255.250 udp dpt:1900 4507 244K ufw-user-input all -- * * 0.0.0.0/0 0.0.0.0/0 Chain ufw-before-logging-forward (1 references) pkts bytes target prot opt in out source destination Chain ufw-before-logging-input (1 references) pkts bytes target prot opt in out source destination Chain ufw-before-logging-output (1 references) pkts bytes target prot opt in out source destination Chain ufw-before-output (1 references) pkts bytes target prot opt in out source destination 27445 12M ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0 59060 36M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 21567 2683K ufw-user-output all -- * * 0.0.0.0/0 0.0.0.0/0 Chain ufw-logging-allow (0 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] " Chain ufw-logging-deny (2 references) pkts bytes target prot opt in out source destination 296 12404 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID limit: avg 3/min burst 10 3 120 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] " Chain ufw-not-local (1 references) pkts bytes target prot opt in out source destination 4507 244K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type MULTICAST 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type BROADCAST 0 0 ufw-logging-deny all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain ufw-reject-forward (1 references) pkts bytes target prot opt in out source destination Chain ufw-reject-input (1 references) pkts bytes target prot opt in out source destination Chain ufw-reject-output (1 references) pkts bytes target prot opt in out source destination Chain ufw-skip-to-policy-forward (0 references) pkts bytes target prot opt in out source destination 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain ufw-skip-to-policy-input (7 references) pkts bytes target prot opt in out source destination 86 4284 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain ufw-skip-to-policy-output (0 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain ufw-track-input (1 references) pkts bytes target prot opt in out source destination Chain ufw-track-output (1 references) pkts bytes target prot opt in out source destination 1393 83580 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW 20172 2599K ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW Chain ufw-user-forward (1 references) pkts bytes target prot opt in out source destination Chain ufw-user-input (1 references) pkts bytes target prot opt in out source destination 0 0 DROP all -- * * 77.252.26.62 0.0.0.0/0 0 0 DROP all -- * * 188.162.43.53 0.0.0.0/0 0 0 DROP all -- * * 77.40.52.94 0.0.0.0/0 0 0 DROP all -- * * 186.206.168.111 0.0.0.0/0 0 0 DROP all -- * * 77.40.62.199 0.0.0.0/0 0 0 DROP all -- * * 103.242.117.49 0.0.0.0/0 0 0 DROP all -- * * 138.121.244.253 0.0.0.0/0 0 0 DROP all -- * * 77.40.2.180 0.0.0.0/0 0 0 DROP all -- * * 77.243.24.0/22 0.0.0.0/0 0 0 DROP all -- * * 181.112.204.100 0.0.0.0/0 0 0 DROP all -- * * 202.129.0.42 0.0.0.0/0 0 0 DROP all -- * * 141.98.80.0/24 0.0.0.0/0 40 1600 DROP all -- * * 185.211.245.128/25 0.0.0.0/0 356 22784 ACCEPT tcp -- * * xxx.xxx.xxx.xxx 0.0.0.0/0 tcp dpt:712 0 0 ACCEPT tcp -- * * xxx.xxx.0.0/16 0.0.0.0/0 tcp dpt:712 11 660 ACCEPT tcp -- * * xxx.xxx.xxx.0/21 0.0.0.0/0 tcp dpt:712 31 1868 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:732 617 32728 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 144 7956 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 278 14936 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 5 244 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:465 Chain ufw-user-limit (0 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] " 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable Chain ufw-user-limit-accept (0 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain ufw-user-logging-forward (0 references) pkts bytes target prot opt in out source destination Chain ufw-user-logging-input (0 references) pkts bytes target prot opt in out source destination Chain ufw-user-logging-output (0 references) pkts bytes target prot opt in out source destination Chain ufw-user-output (1 references) pkts bytes target prot opt in out source destination
It looks as if the attacker is able to punch a hole in the firewall. It also looks like other allowed tcp connections are required to do that, because if I put the drop rules before all allow rules he can’t establish a tcp connection to the imaps server.
Another information is that when I changed the imaps port, I didn’t see a port scan in the logs. The attacker manage to do something to locate the new port while staying below the radar.