You could use something like: fail2ban to handle IP restrictions
I'm rarely seeing more than one or two requests per IP. That's
why I'm blocking a network at a time.
Now I've blocked 1600 networks and the probes are down to a trickle.
I can't say I've seen any unusual patterns lately, as such - just the
usual background noise, which obviously includes the continuous
low-count distributed attempts that have long since become the norm.
Unwanted traffic in general is dominated by 443, 80, 465 and then 587,
followed by everything else (22, 25, 23(!), 143 and so on).
I have both fail2ban and CrowdSec triggering on credential stuffing
(and reporting to a plethora[1] of services whenever filters get
tripped), but (very much) unlike the filters for 443/80, these hardly
ever trigger. Not because nobody ever tries - the numbers above prove
otherwise - but because the IPs that would are already being blocked by
blocklists, or because the number of attempts per IP are so low as to
not warrant any decisive action.
A number of blocklists are in use, with varying degrees of relevance.
The crowd-sourced AbuseIPDB tends to have a pretty good hit rate, but
the most hits by far come from Junk Email Filter's auth list[2]. This
list alone - intended for this specific purpose - tends to catch the
vast majority of submission noise, and so in my experience is pretty
much accomplishing exactly what it says on the tin. Being a pure
submission honeypot, it's targeted at exactly this, and every attempt -
even a single one - can be recorded with cofidence.
To consume the list, I use update-ipsets[3] from the FireHOL project.
You don't need to be using FireHOL as your firewall to use it - it just
keeps an ipset (nftsets are a long-standing feature request[4])
up-to-date, from which you can create any rules you like - such as
REJECTing or DROPing connections against ports 465 and 587 (which is
what I do). Together with iprange[5] from the same project, the list is
also optimized when abusers gain control over entire subnets etc.
Note that JMF's auth-hack list is not offered by default by
update-ipsets (though many other lists are - AbuseIPDB was added
earlier this year), but it supports adding custom definitions. One
thing to look out for wrt JMF is that their Let's Encrypt cert is
incorrectly deployed (the intermediate cert is missing from the chain,
sering only the leaf) - their entire TLS setup frankly could do with a
good touch-up. Browsers won't mind due to their supporting AIA
Fetching, but other clients will fail validation, so you'll have to
accept and work around that if you wanna consume this list.
Here's my update-ipsets definition for it:
$ cat /etc/firehol/ipsets.d/jmf-auth-hack.conf
update jmf-auth-hack 30 0 ipv4 ip \
https://ipadmin.junkemailfilter.com/auth-hack.txt \
remove_comments \
"reputation" \
"[JunkEmailFilter auth hack](https://www.junkemailfilter.com/)
JunkEmailFilter fake auth" \
"JunkEmailFilter" "https://www.junkemailfilter.com/"; \
can_be_empty \
downloader_options "--insecure"
YMMV may vary, but for me this list has proven remarkably effective.
For your typical HTTPS traffic, no amount of lists will ever be enough,
but for submission JMF (and to an extent AbuseIPDB) have mostly made
this a solved problem here (sans the remaining distributed
single-attempt noise). It feels worth highlighting the JMF list in
particular since it's proven so valuable for exactly this, and yet it
doesn't seem to get a lot of love. I very rarely see it referenced, and
when posting about it now, I couldn't even find information on their
website to link to, and can no longer remember how I came across it
originally.
[1] AbuseIPDB, Blocklist.de, DShield, Abusix, IPThreat, IPInsights and
CrowdSec
[2] <https://ipadmin.junkemailfilter.com/auth-hack.txt>
[3] <https://github.com/firehol/firehol/blob/master/sbin/update-ipsets>
[4] <https://github.com/firehol/firehol/issues/352>
[5] <https://github.com/firehol/iprange/wiki>
--
Christer
_______________________________________________
mailop mailing list -- [email protected]
To unsubscribe send an email to [email protected]
