Blocking SMTP logins from particular countries

Silent Ninja

Well-Known Member
Apr 18, 2006
196
0
166
Buenos Aires, Argentina
I've noticed that every time an e-mail's password gets compromised, multiple servers from all around the world connect to it and start spamming, but it's almost never from the same countries were we offer services to (ie. bots connect from Russia, China, Ukraine, some country in Africa or Middle East).

By disallowing these countries to login we would be adding a new layer of security since bots have already learned how to bypass LFD restrictions.

I don't want to deny access via HTTP to the service (for now) and blocking entire countries using iptables is not very efficient (although I haven't tried it since IPSET was created).

As far as I know cpHulk only affects cPanel services (which would help with the webmail except on the proxy subdomains) but it does not affect dovecot, so they're still able to spam using SMTP.

Is there a way to add geo-detection and restrictions to dovecot logins?
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,909
2,227
463
Hello,

We added new functionality to cPHulk in cPanel & WHM version 70 that appears to match what you are looking for:

In cPanel & WHM version 70, we added the ability for users to whitelist or blacklist entire countries. To perform this action, navigate to the Countries Management tab of WHM's cPHulk Brute Force Protection interface (WHM >> Home >> Security Center >> cPHulk Brute Force Protection).
Email authentication is handled by dovecot, and dovecot is in-fact covered as one of the services protected by cPHulk.

Thank you.