E-mail self-hosting and hacking/failed login attempts
reddit / selfhosted

----------------------------------------------------------------------
billysmusic · 2023-11-16 16:31

I host my own email and can regularly see people/bots trying to log
into my email and accounts and random others.  I block those IPs as
soon as they try and log in.  I then log basic data about them
(country, reverse DNS).
I created a website that gives some basic statistics about that data
and makes the IPs available if others wanted them.

I called it MX Offenders and I'm mostly doing this as a fun project
for myself.  The site is also self-hosted.
It is at https://mxo.michaelspost.com/
It probably won't be used by anyone, but was fun to create and I
thought I would see what others think.

----------------------------------------------------------------------
falcorns_balls · 2023-11-16 18:57

look into fail2ban as well. you can configure it to block IPs that are
fail authentication after a certain number of attempts. it watches
logs so you can configure it for smtp or ssh or whatever.

----------------------------------------------------------------------
billysmusic · 2023-11-16 19:02

I mention it on the site, but I didn’t here. I’ve used it for other
things but wanted to write my own.

----------------------------------------------------------------------
RedditSlayer2020 · 2023-11-16 20:32

Very nice im addicted to logging aswell but it gets boring after a
while.

Keep LOGGING bro

----------------------------------------------------------------------
buttstuff2023 · 2023-11-17 03:32

I did something similar with Graylog and ssh login attempts. Even had
a neat little real-time global map with dots on the location the
attempts originated from.

I get surprisingly few login attempts on my mail server though.

----------------------------------------------------------------------
rrrmmmrrrmmm · 2023-11-21 13:06

Is it possible to integrate that list with Stalwart? [Like
DNSBL](https://stalw.art/docs/spamfilter/dnsbl/#ip-address-checks) or
so?

/CC /u/StalwartLabs

----------------------------------------------------------------------
billysmusic · 2023-11-21 13:17

I’m not familiar with Stalwart. I will need to look into that and
DNSBL.

----------------------------------------------------------------------
rrrmmmrrrmmm · 2023-11-21 13:24

Oh that would be lovely!

----------------------------------------------------------------------
billysmusic · 2023-11-22 15:52

Ok, I believe I have a DNSBL up and working.  Details are at
https://mxo.michaelspost.com/get_data

----------------------------------------------------------------------
rrrmmmrrrmmm · 2023-11-22 16:16

Nice, thank you! <3