Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Failed Dovecot Logins

Discussion in 'E-mail Discussions' started by keat63, Jun 28, 2017.

Tags:
  1. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    885
    Likes Received:
    26
    Trophy Points:
    28
    cPanel Access Level:
    Root Administrator
    My users don't use webmail, and all have static configured office PC's, so have no requirement to know thier own email password, for this reason I'm utilising CSF, where I have IMAP, SMTP or POP3 login failure configured for 1 strike and your'e blocked.

    This works, and i see IP's being blocked daily.

    However, occasionally, I see CPHULK protecting me against failed Dovecot logins.
    This is configured for 4 strikes and your'e out.

    Can anyone explain why Dovecot is not being triggered by CSF but pop3, SMPT and IMAP are.
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    38,658
    Likes Received:
    1,425
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Could you provide some more details about the specific cPHulk log entry in-question? POP3 and IMAP are both handled with Dovecot.

    Thank you.
     
  3. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    885
    Likes Received:
    26
    Trophy Points:
    28
    cPanel Access Level:
    Root Administrator
    Here is one from last night.

    Code:
    Brute Force attempt against “backuppc@www.mydoamin.uk”.
    
    A device at the “xxx.xxx.xx.xxx” IP address has made a large number of invalid login attempts against the account “backuppc@www.mydomain.uk”. This brute force attempt has exceeded the maximum number of failed login attempts that the system allows. For security purposes, the system has temporarily blocked this IP address in order to prevent further attempts.
    
    Service:
    
    dovecot
    
    Local IP Address:
    
    xxx.xxx.xxx.xxx
    
    Local Port:
    
    110
    
    Remote IP Address:
    
    xxx.xxx.xxx.xxx
    
    Remote Port:
    
    38072
    
    Authentication Database:
    
    mail
    
    Username:
    
    backuppc@www.mydomain.uk
    
    Number of authentication failures:
    
    4
    
    
     
    #3 keat63, Jun 29, 2017
    Last edited: Jun 29, 2017
  4. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    885
    Likes Received:
    26
    Trophy Points:
    28
    cPanel Access Level:
    Root Administrator
    CPHULK Screen Shot
     

    Attached Files:

  5. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    38,658
    Likes Received:
    1,425
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Port 110 is utilized for POP3 connections. Do you see any corresponding entries for the offending IP address in /var/log/maillog?

    Thank you.
     
  6. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    885
    Likes Received:
    26
    Trophy Points:
    28
    cPanel Access Level:
    Root Administrator
    I think I may have figured this out.

    CPHULK is configured to check for failed logins over a set period, and CSF was configured for 2 strikes on POP3, not 1.

    If the hacker had a failed login, then went away for a while, CSF wouldn't pick him up.
    If he came back for another attempt, again CSF wouldn't detect him.
    He could do this 4 times before CPHulk picked him up.
     
  7. CrazyforLinux

    CrazyforLinux Registered

    Joined:
    Jun 6, 2017
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Ahmedabad
    cPanel Access Level:
    Root Administrator
    Hello Keat,

    For your information, CPHULK is used for brute-force detection and failed login blocking and CSF is prepared with advanced options. The CSF will automatically detects DOS Attacks, DDOS Attacks as well as Brute-force detection and failed login attempts.
     
Loading...

Share This Page