dovecot - Jul 2017 - under some kind of attack

> I would like to  create a fail2ban filer, that scans for these lines:
>
>> Jul 20 11:10:09 auth: Info:
ldap(user1,60.166.35.162,<cDFXHbxUQgA8piOi>): invalid credentials (given
password: password)
>> Jul 20 11:10:19 auth: Info:
ldap(user2,61.53.66.4,<V+nyHbxU+wA9NUIE>): invalid credentials (given
password: password)
>
> (as you can see, I have enabled auth_verbose_passwords to do this,
> making me very uncomfortable...)
>
> Anyway: since there are only a few password variations, I would like to
> block anyone using those passwords.
With all the constraints and processing, I'll offer yet another option:
use the checkpassword password authentication scheme.  This will bypass
post-authentcation log-sniffing and allow you direct access to username,
password and client IP (the last I'm not positive about) at authentication
time.

Now you'll have everything you need to do any wild and crazy auth
processing, including database searches and triggering firewall blocking
based on whatever crietria you want (including common password use).

As to how to integrate it into your dovecot, I'm not sure whether it's
best to supplant the LDAP method and authenticate within the checkpassword
script, or to put it as the first authentication method (ahead of LDAP)
to get first crack at inspect at authentication data, or the fallback
authentication method (after LDAP) to pick up all the failures.

However, after running honeypots, I can tell you that although BFD
attackers will common use passwords, any static list of abused passwords
will miss a lot.  (A common one they use is $password=variations($user)
or variation($domain)).  Number of auth failure limits should also be
a criteria for banning.  Extinct users are also good candidates for
instant banning.

Joseph Tam <jtam.home at gmail.com>

Not applicable to most installations, but I use geographical filtering on all
ports other than 25. Fine if you are the only user of the email system. I
don't block countries where I will send and retrieve email. I augment this
with a small blocking list of IP space where I'm OK if they read my
websites, but won't be sending/receiving email from their physical location.
In short, schools and universities. So for example I would have trouble sending
mail from the University of Michigan or anywhere in Kahzakstan.

I get one hacker a week trying to guess passwords, and always from Digital Ocean
VPS. I just block them as the occur. I have list of data centers that have tried
to hack my web server, which I also block from the email server other than port
25.

I would like to see statistics on the success of such brute force attacks. They
can't be very successful these days.