1

Today I had a few users blocked in our server firewall because of:

(smtpauth) Failed SMTP AUTH login from

Can someone explain the reason? What does it exactly mean? Could someone be using the our website to access SMTP for spamming purpose?

UPDATE:

Server info: Centos OS with CPanel and WHM. However no one has access to either.

Taking a look at the logs it looks like someone repetitively attempted to login with a known existent user/pass.

  • Can you please update your question with more details about your server. What OS, mail server and hosting control panel? This will help give a more precise answer. Also have you checked your server's authentication logs? If so, provide examples - you can scrub out the ips or other personal information. – jeffatrackaid Aug 19 '14 at 20:35
1

This link gives us a clue:

https://isc.sans.edu/forums/diary/CSAM+WebHosting+BruteForce+logs/16733

It appears that you have a script that blocks suspect accesses found in your log files. This is good, however, it may be blocking valid users too. You can find out more here: http://configserver.com/cp/csf.html

It appears from your error that you may be experiencing a brute force password cracking effort against your SMTP server (e-mail). This is bad, however, your script is protecting you.

This script may be blocking a specific IP address from a pool or blocking a domain name that represents a user pool which would block all users of that pool.

You can block the specific IP address found in your log files using firewall or iptables or whatever mechanism you have that restricts access to your server. If you have a domain name, you can use:

nslookup example.com

...to lookup the IP address.

If the domain name is something like generic-term.example.com where generic term can be something like user, customer, host, or something similar, then you may not get an IP address or at least not the proper one. This is a domain name of a pool like I suggested above. If you do not have an IP address in your log file, then blocking the pool may restrict valid accesses from that entire network. Even blocking the IP address can block accesses from a valid user. Even then, tomorrow the same thing can happen from another IP address from that pool.

There may be nothing you can do either way but to block access and suffer the consequences. It may be that you will need to keep an eye on your log files and block accesses by IP address as they occur.

Without more specific information, I am unable to give better advice except this. You want this script to do what it is doing. You may need to apologize to a few users, but at least you are not sending out thousands of spam e-mail from a hacked account.

|improve this answer|||||
  • Thanks. I tracked down the issue and the IP address and it looks like one of our clients tried to setup emails using our SMTP, they didn't realize that they have their own email accounts separately from our server which hosts their website. So they got their IP blocked, which in this case it wasn't a good thing because it meant our client lost access to the website. Allowing their IP address in the firewall fixed it. – gdaniel Aug 20 '14 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.