Help what happened reddit / selfhosted ---------------------------------------------------------------------- SuperWill5633 路 2023-11-12 16:59 So I have set up my own mail server 馃檭 馃檪. What an achievement for me 馃槅馃槄 And it was working fine till recently. It becomes really, really slow. And I checked the log and found out this. What could I do and what's the purpose of this? Is it a brute force attack? All these ips are owned by the same person/group?? Any help or pointers will be deeply appreciated ---------------------------------------------------------------------- lews--therin 路 2023-11-12 17:36 Now you know why a private mailserver is a pain. Fail2ban can save your day. ---------------------------------------------------------------------- Sparrow538 路 2023-11-12 18:49 Spammers have found your server. It's probably been compromised at this point. ---------------------------------------------------------------------- ElevenNotes 路 2023-11-12 18:59 Nice shot in the dark there buddy. ---------------------------------------------------------------------- ElevenNotes 路 2023-11-12 19:00 It saves nothing, just blocks the IP, which OP could do by hand at this point. ---------------------------------------------------------------------- lews--therin 路 2023-11-12 19:04 That is true, but fail2ban will prevent the next one or am I missing something? Perhaps you got a better suggestion? ---------------------------------------------------------------------- ElevenNotes 路 2023-11-12 19:07 All fail to ban can and will do is block the IP on that port, does not prevent SYN or ACK flooding on his router. Fail2ban is poor mans IDS. ---------------------------------------------------------------------- therealR5 路 2023-11-12 21:26 Yeah that looks a lot like the typical bruteforce attempts from the evil lands of the internet. Fail2ban did the trick for me. Logs are clean now ---------------------------------------------------------------------- ElevenNotes 路 2023-11-12 22:06 logs clean = all good? Gotta love the gullible people on this sub. ---------------------------------------------------------------------- SuperWill5633 路 2023-11-13 00:09 But the ips used in the attacks are not the same...fail2ban is active in my server but it didn't ban anything since every ip user only failed once for the password ---------------------------------------------------------------------- SuperWill5633 路 2023-11-13 00:13 So I should just set f2b to ban ips for 1 failure? It's weird that the perdon owns a while lot of ips and doing shoot like this... ---------------------------------------------------------------------- NoNameJustASymbol 路 2023-11-13 02:48 \^ He's right ya know. ---------------------------------------------------------------------- NoNameJustASymbol 路 2023-11-13 02:52 The 'UGFzc3dvcmQ=' value is 'Password' Base64 encoded. That's the Internet for ya. Harden your Postfix. Make better use of fail2ban - it's ok to use 'maxretry = 1'. ---------------------------------------------------------------------- NoNameJustASymbol 路 2023-11-13 03:21 >All fail to ban can and will do is block the IP on that port, does not prevent SYN or ACK flooding on his router. That's not correct. With core fail2ban functionality an IP can be blocked on all ports, all protocols. That's trivial. With a little bit of work the same can be accomplished but instead of an IP it's a CIDR. Floods can also be handled by rate limiting. All that is done in fail2ban's actions. \* Disclaimer - 99% of my experience with fail2ban is with only netfilter (uh, "iptables"). It's possible some of what I have in my setup may not work with another firewall. ---------------------------------------------------------------------- ElevenNotes 路 2023-11-13 05:55 It's what's thaught and reinforced on this sub. I mean look at the downvotes. ---------------------------------------------------------------------- ElevenNotes 路 2023-11-13 05:58 You seem to miss the part where I talk about SYN, ACK flood on the L3 device and the IP block prevents nothing but I do not expect someone on a sub like this to understand what a null route is. ---------------------------------------------------------------------- mrkesu 路 2023-11-13 08:39 If there's one thing I've learned over the years about self-hosting it's that I'll happily pay to not have to deal with email hosting. The only "self-hosting" I do for email is to download my own local archive for storage. ---------------------------------------------------------------------- NoNameJustASymbol 路 2023-11-13 15:23 It's not a big deal to me and I'd rather have control over the services and, more importantly, the data. And my rented server is cheap.