• Dear Pleskians! The Plesk Forum will be undergoing scheduled maintenance on Monday, 7th of July, at 9:00 AM UTC. The expected maintenance window is 2 hours.
    Thank you in advance for your patience and understanding on the matter.

Question plesk_saslauthd - Attack, no IP seen

Gjimi

Basic Pleskian
Server operating system version
Debian 10
Plesk version and microupdate number
18.0.59
plesk_saslauthd is under attack, there are thousands of the:

plesk_saslauthd[17936]: No such user '[email protected]' in mail authorization database
plesk_saslauthd[17936]: failed mail authentication attempt for user '[email protected]' (password len=13)

in the logs.
(just something)

no IP to see no further information.
 
The plesk_saslauthd log entires are accompanied by postfix/smtpd log entires. These do contain the IP address from which the login attempt is made.

Looks something like this
Scherm­afbeelding 2024-04-11 om 10.47.10.png
 
just none! otherwise the IP would have been blocked or Fail2Ban does it, but he can't because no IP can be seen, I wrote.

Apr 11 15:43:39 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:39 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=6)
Apr 11 15:43:42 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:42 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=6)
Apr 11 15:43:42 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:42 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=6)
Apr 11 15:43:43 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:43 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=13)
Apr 11 15:43:45 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:45 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=13)
Apr 11 15:43:45 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:45 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=9)
Apr 11 15:43:45 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:45 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=9)
Apr 11 15:43:45 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:45 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=9)
Apr 11 15:43:50 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:50 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=13)
Apr 11 15:43:51 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:51 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=13)

and just keep it up, nothing different
 
Interesting. I don't know why that is. Best suggestion I can offer is to contact Plesk support to let them investigate the issue.
 
The plesk_saslauthd log entires are accompanied by postfix/smtpd log entires. These do contain the IP address from which the login attempt is made.

Looks something like this
View attachment 25899
@Kaspar FWIW, we've added a post to THIS old thread in which, we've posted an example of logged data c/w IP addresses etc. Plesk appears to use saslauthd differently than the OE Ubuntu 24.04 config, so it takes time, to fully comprehend that. AFAWK there's no DFDs or schematics available for the Plesk configuration, which is a shame as that would provide a much clearer understanding for all. @mar-ek You're mentioned in the post that's referred to above.
 
Back
Top