Question Firewall - How to add multiple IP's to Rule?

[blackcapsteve]

Hi
One of my customers had an email address hacked. This resulted in my external SMTP provider suspending their account after 2,000 (good..) and 6,000 left in my outgoing queue.
The SMTP guys sent an email, and I immediately suspended all mail activity on the customer, and cleared the out queue. I then deleted the email address, and then rebuilt it. All of the customers email addresses were then provided with ultra complex passwords.
I also invoked the 'only allowed to send x emails / hour' portion of the mail system. I tested this, and it works great. Now my system will stop the hack, report to me, long before the SMTP suspends me.

I decided (during the time when the email address was deleted) to examine in detail the mail log. Sure enough - there were hundreds/thousands of attempts to login and send using the email address.

I started to externally analyse my mail log (using self written software) and came up with the IP's which were the main culprits, plus stats as to how many times they had tried to send mail through my server. The very bad boys were in the high hundreds.. so I entered them immediately into a STOP-IP rule.

Each night I process the days mail log and anyone over 10 attempts gets blocked (this is purely because of the reason below) - On day one I had 80 over 10 - now its usually 2

Its working - every day the hits on my mailserver are reducing. I know its retrospective.. I know that the bad boys will just use an IP address I haven't logged yet.. but its making me feel I am doing something. I even found one IP which was a working website - I sent an email with a pdf log of the 181 attempts and it stopped (immediately).

Heres my question - I am having to add each IP address ONE AT A TIME. This is the bottleneck in my system. I am cutting and pasting from my To Be Blocked List.. but its a chore.

Is there a way of loading multiple IP addresses into my Firewall

regards

Blackcapsteve

 

[learning_curve]

You haven't mentioned Fail2Ban in your post (there maybe a reason...) Still, have a read of this post: Question - Huge attack on Mailbox Read the whole thread really, but that post will probably be helpful for you. If you spend time setting it up properly, we've found Fail2Ban can be quite effective. This thread: Resolved - What plesk_saslauthd is for? we found very useful too

 

[blackcapsteve]

You haven't mentioned Fail2Ban in your post (there maybe a reason...) Still, have a read of this post: Question - Huge attack on Mailbox Read the whole thread really, but that post will probably be helpful for you. If you spend time setting it up properly, we've found Fail2Ban can be quite effective. This thread: Resolved - What plesk_saslauthd is for? we found very useful too

I will look at your links.. there is a reason I have yet to try Fail2Ban.. I am not a Linux person, so if I cant do it through Plesk I am uneasy about mucking things up. I thought I would allay those fears by installing Centos7 on a computer at home and using it as a web test bed. I am however a programmer.. and am much happier in the Windows / IBM iseries environment. Thats why I do my processing offline.
When I am more confident with Centos7 I will have a go at Fail2Ban. Still wanting the 'multiple IP to a firewall' question though.

 

[learning_curve]

....so if I cant do it through Plesk I am uneasy about mucking things up

But you can operate Fail2Ban through Plesk...
There's a useful Plesk related document here: Protection Against Brute Force Attacks (Fail2Ban)

...When I am more confident with Centos7 I will have a go at Fail2Ban. Still wanting the 'multiple IP to a firewall' question though.

The level of CentOS experience, won't really limit what you can do already with Plesk & Fail2Ban. Just take your time, read all the Plesk docs and patiently search in this forum. Fail2Ban will go a long way to answering your "multiple IP" questions

 

[blackcapsteve]

Thanks for that.. I feel more confident in giving Fail2ban a try..

I did have something happen today. This has opened my eyes as to what goes on.

My customer was hacked again - This time the upper limit of 10 saved the day for the two compromised accounts. That was the extent of the damage.
A scan of his computer using superantispyware produced nothing. But.. running malwarebytes produced a sickening level of infection, which clearly was the cause.
My logs showed me that the 11 messages were sent by one IP, but as soon as I turned off the mailservice for the customer, the attempts to access the accounts were performed by another IP - ONCE! Then the IP was continually switched for another attempt - ONCE. This means that they will never trigger Fail2ban. It seems as the dark side have figured this out. My system spots all those authorisation failures.. its just too much to load into the firewall.

So - all passwords reset to hideous complexity.. computer cleaned.. and we are off again. For me the saviour of the situation was 'Limit the number of emails sent by an email address / mailbox / customer'. It is brilliant!

Thanks for your time.

 

[Brujo]

glad that the limits saved your day....

My system spots all those authorisation failures.. its just too much to load into the firewall.

As an idea, I often suggest to use fail2ban together with ipsets. With ipsets you can handle a hugh amount of blocked ips easily. There are some Forum thread here about it