Blocking SMTP logins from particular countries

[Silent Ninja]

I've noticed that every time an e-mail's password gets compromised, multiple servers from all around the world connect to it and start spamming, but it's almost never from the same countries were we offer services to (ie. bots connect from Russia, China, Ukraine, some country in Africa or Middle East).

By disallowing these countries to login we would be adding a new layer of security since bots have already learned how to bypass LFD restrictions.

I don't want to deny access via HTTP to the service (for now) and blocking entire countries using iptables is not very efficient (although I haven't tried it since IPSET was created).

As far as I know cpHulk only affects cPanel services (which would help with the webmail except on the proxy subdomains) but it does not affect dovecot, so they're still able to spam using SMTP.

Is there a way to add geo-detection and restrictions to dovecot logins?

 

[cPanelMichael]

Hello,

We added new functionality to cPHulk in cPanel & WHM version 70 that appears to match what you are looking for:

In cPanel & WHM version 70, we added the ability for users to whitelist or blacklist entire countries. To perform this action, navigate to the Countries Management tab of WHM's cPHulk Brute Force Protection interface (WHM >> Home >> Security Center >> cPHulk Brute Force Protection).

Email authentication is handled by dovecot, and dovecot is in-fact covered as one of the services protected by cPHulk.

Thank you.