The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Huge increase of Dovecot Brute Force

Discussion in 'Security' started by hello-electro, Apr 22, 2017.

Tags:
  1. hello-electro

    hello-electro Member

    Joined:
    Aug 9, 2016
    Messages:
    17
    Likes Received:
    1
    Trophy Points:
    3
    Location:
    Maryland
    cPanel Access Level:
    Root Administrator
    Anyone else getting bruteforce notices against dovecot? I am up to about 1 per 3 minute. Its coming from a botnet, so no way for me to just block a single IP. There is only a minor mention of a timing vulnerability that i can find online. Is cPanel folks aware of this, or have any suggestions to ensure the bruteforce doesn't lead to a successful comprimise?
     
    #1 hello-electro, Apr 22, 2017
  2. BlackRain

    BlackRain Well-Known Member

    Joined:
    May 28, 2003
    Messages:
    51
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    USA
    cPanel Access Level:
    Root Administrator
    Yep. I have noticed the same activity from IP's all over the world trying to brute force Dovecot credentials. There must be an exploit in the wild. Have not seen any notice from Cpanel about this issue.
     
    #2 BlackRain, Apr 22, 2017
  3. hello-electro

    hello-electro Member

    Joined:
    Aug 9, 2016
    Messages:
    17
    Likes Received:
    1
    Trophy Points:
    3
    Location:
    Maryland
    cPanel Access Level:
    Root Administrator
    I have a link to what may be a known exploit (nothing I discovered), though its a few weeks old at this point, so the attempts may just be residual at this point. I'm going to send the cPanel folks a support ticket with it.
     
    #3 hello-electro, Apr 22, 2017
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    37,094
    Likes Received:
    1,288
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Internal case CPANEL-12790 was opened to inquire about that specific vulnerability. We'll update the version of Dovecot offered through cPanel with any security-related patches once Dovecot publishes them upstream.

    In addition to using cPHulk, you may also want to consider using a third-party application such as CSF to help protect against brute force attempts:

    ConfigServer Security & Firewall (csf)

    Thank you.
     
    #4 cPanelMichael, Apr 24, 2017
  5. BlackRain

    BlackRain Well-Known Member

    Joined:
    May 28, 2003
    Messages:
    51
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    USA
    cPanel Access Level:
    Root Administrator
    Already use CPHulk and CSF, yet we are getting hundreds of Dovecot brute forces attempts (mostly from China and dubious EU server farms).

    We have black listed those IP ranges yet new ones keep popping up.

    We don't use any server side email so it's a wasted attempt on their part.

    So that leads me to believe there is an exploit out there.
     
    #5 BlackRain, Apr 25, 2017
  6. Jasminder pal Singh

    Jasminder pal Singh Registered

    Joined:
    May 30, 2017
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Punjab
    cPanel Access Level:
    Root Administrator
    Hey ,
    Any update on this yet ?
     
    #6 Jasminder pal Singh, May 30, 2017
  7. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    37,094
    Likes Received:
    1,288
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    The particular vulnerability referenced earlier in this thread is addressed by Dovecot in Dovecot 2.2.30:

    Internal case CPANEL-13448 is open for the inclusion of this version of Dovecot into cPanel & WHM. I'll update this thread with more information on the status of this case as it becomes available.

    Thank you.

    Edit: Dovecot 2.2.31 is now included with cPanel version 66:

    Implemented case CPANEL-14248: Update dovecot to 2.2.31-1.cp1162.
     
    #7 cPanelMichael, Jun 1, 2017
    Last edited: Jul 18, 2017
(You must log in or sign up to post here.)
Loading...
Similar Threads - Huge increase Dovecot
  1. linux4me2

    ModSecurity Logs Are Getting Huge With Logging Off

    linux4me2, Jun 29, 2017, in forum: Security
    Replies:
    1
    Views:
    163
    cPanelMichael
    Jun 29, 2017
  2. DubCity

    How To Export Huge Database?

    DubCity, Jun 11, 2016, in forum: Database Discussions
    Replies:
    8
    Views:
    916
    cPanelMichael
    Jun 16, 2016
  3. fcomstoc

    Huge Email Issue

    fcomstoc, Jun 6, 2016, in forum: E-mail Discussions
    Replies:
    4
    Views:
    595
    cPanelMichael
    Jun 8, 2016
  4. Erik Knepfler

    huge 22GB rc4.txt file in /root

    Erik Knepfler, May 24, 2016, in forum: General Discussion
    Replies:
    2
    Views:
    436
    Erik Knepfler
    Jun 9, 2016
  5. Nirjonadda

    Could not increase number of max_open_files to more than 50000

    Nirjonadda, Jul 25, 2017, in forum: Database Discussions
    Replies:
    3
    Views:
    116
    cPanelMichael
    Jul 25, 2017

Share This Page