0

I recently configured cPanel on my VPS. And today I saw the logs in /var/log/messages showing some IP keeps trying to login and failed:

Oct 19 18:10:30 servername dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=, method=PLAIN, rip=181.28.12.12, lip=xxx.myip.xxx.xxx

I found this because I saw a cPanel alerting email about "imap failed @ Sat Oct 19 17:39:54 2013. A restart was attempted automagically."

this error keeps showing up almost per second base. Oh geez... How to stop this? Any way to prevent this IP from accessing my mail server?

Thanks.

1 Answer 1

0

I ended up using a straight forward method... block the IP via iptables

(1) edit iptables

vi /etc/sysconfig/iptables

(2) add a line on the top of -A list (if you add it in the lower part, there is a chance it might not work because earlier conditions are met so the packets you are trying to block are still allowed to go through... I had this problem in the beginning and finally found the reason)

-A INPUT -s xxx.xxx.xxx.xxx -j DROP

(3) restart iptables

/etc/init.d/iptables restart

That's it. The login attempts finally gets stopped.

I also found people are saying to use 'fail2ban'. I may try it if there are more different IPs trying to brute attack.

2
  • FYI: Your idea works fine for a small number of IP address, but if you find yourself needing to add a lot more combine iptables with ipset. If you add 2000 ip addresses this way your internet speed will slow way down and your cpu utilization will go way up. If you use ipset in combination with iptables 20000 ip's will have very little performance impact.
    – cybernard
    Oct 20, 2013 at 16:33
  • @cybernard thanks a lot for the info. I will look into ipset too.
    – Joe Huang
    Oct 21, 2013 at 0:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .