The SMTP auth attack was still going on ... / 2010-04-06

2010-04-06 The SMTP auth attack was still going on ...
The SMTP auth attack was still going on this morning so I decided to play a bit with the sendmail access config:
SRV_Features:92.241.190.15 A
This disables offering AUTH to the specific attacking IP. The result was interesting in SMTP sessions:
220 kzdoos.xs4all.nl ESMTP Sendmail 8.14.2/8.14.2/Debian-2build1; Tue, 6 Apr 2010 08:25:06 +0200; (No UCE/UBE) logging access from: [92.241.190.15](FAIL)-[92.241.190.15]
9_@@
EHLO hbwgxr.com
250-kzdoos.xs4all.nl Hello [92.241.190.15], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-EXPN
250-VERB
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-STARTTLS
250-DELIVERBY
250 HELP
RSET
250 2.0.0 Reset state
RSET
250 2.0.0 Reset state
RSET
250 2.0.0 Reset state
RSET
250 2.0.0 Reset state
RSET
250 2.0.0 Reset state
RSET
250 2.0.0 Reset state
The attacking script leaves out the authentication attempts and just goes on doing nothing. After a short while the attack from 92.241.190.15 stopped.

Tags: ,

IPv6 check

Running test...
, reachable as koos+website@idefix.net. PGP encrypted e-mail preferred. PGP key 5BA9 368B E6F3 34E4 local copy PGP key 5BA9 368B E6F3 34E4 via keyservers

RSS
Meningen zijn die van mezelf, wat ik schrijf is beschermd door auteursrecht. Sommige publicaties bevatten een expliciete vermelding dat ze ongevraagd gedeeld mogen worden.
My opinions are my own, what I write is protected by copyrights. Some publications contain an explicit license statement which allows sharing without asking permission.
Other webprojects: Camp Wireless, wireless Internet access at campsites, The Virtual Bookcase, book reviews
This page generated by $Id: newsitem.cgi,v 1.55 2021/11/09 13:09:49 koos Exp $ in 0.004108 seconds.