[LBBS-46] Block malicious mail servers after repeated failures
mod_events is used to automatically block IP addresses for things like spam/bot connections, but this seems to be a case that isn't handled yet:
[2024-06-30 13:24:57.014] DEBUG[2898730]: node.c:2072 bbs_node_begin: Running BBS for node 4
[2024-06-30 13:24:57.014] AUTH[2898730]: node.c:2073 bbs_node_begin: New SMTP connection to node 4 from 193.32.162.53:56354
[2024-06-30 13:24:57.014] DEBUG[2898730]: net_smtp.c:431 handle_connect: 0x7f3f32f11f90 <= 220-$BBS_HOSTNAME ESMTP Service Ready
[2024-06-30 13:24:57.017] ERROR[2898730]: socket.c:402 bbs_hostname_has_ip: getaddrinfo(pex44.dream-bal.com): Temporary failure in name resolution
[2024-06-30 13:24:57.017] WARNING[2898730]: net_smtp.c:415 fcrdns_check: FCrDNS check failed: pex44.dream-bal.com != 193.32.162.53
[2024-06-30 13:24:57.017] DEBUG[2898730]: net_smtp.c:352 smtp_tarpit: 0x7f3f32f11f90: Current number of SMTP failures: 5
[2024-06-30 13:24:57.018] DEBUG[2898730]: node.c:429 bbs_node_safe_sleep: Sleeping on node 4 for 5000 ms
[2024-06-30 13:24:57.061] DEBUG[2898719]: net_smtp.c:371 smtp_tarpit: 0x7f3f3771af90 <= 220-Waiting for service to initialize...
[2024-06-30 13:24:57.061] DEBUG[2898719]: node.c:429 bbs_node_safe_sleep: Sleeping on node 5 for 5000 ms
[2024-06-30 13:24:57.197] DEBUG[2898719]: node.c:441 bbs_node_safe_sleep: Node 5 sleep interrupted: poll returned 1
[2024-06-30 13:24:57.198] DEBUG[2898719]: mod_mail.c:228 mailbox_dispatch_event: Dispatching mailbox event 'Logout'
[2024-06-30 13:24:57.198] DEBUG[2898719]: node.c:2086 bbs_node_exit: Node 5 has ended its SMTP session
[2024-06-30 13:24:57.198] DEBUG[2898719]: node.c:531 node_shutdown: Terminating node 5
[2024-06-30 13:24:57.198] DEBUG[2898719]: node.c:604 node_shutdown: Shutdown pending finalization for node 5
[2024-06-30 13:24:57.199] DEBUG[2898719]: node.c:622 node_free: Node 5 now freed
[2024-06-30 13:24:57.199] == Node 5 has exited
[2024-06-30 13:24:57.199] DEBUG[2898719]: thread.c:133 __thread_unregister: Thread 2898719 is exiting (detached)
[2024-06-30 13:24:57.437] DEBUG[2836484]: socket.c:769 tcp_multilistener: Accepting new SMTP connection from 193.32.162.53
[2024-06-30 13:24:57.437] DEBUG[2836484]: node.c:313 __bbs_node_request: Allocated new node with ID 5 (lifetime ID 11148)
[2024-06-30 13:24:57.438] DEBUG[2898731]: thread.c:106 thread_register: Thread 2898731 spawned from l->handler started by thread 2836484 at socket.c:782 tcp_multilistener()
[2024-06-30 13:24:57.438] DEBUG[2898731]: node.c:2072 bbs_node_begin: Running BBS for node 5
[2024-06-30 13:24:57.438] AUTH[2898731]: node.c:2073 bbs_node_begin: New SMTP connection to node 5 from 193.32.162.53:58808
[2024-06-30 13:24:57.438] DEBUG[2898731]: net_smtp.c:431 handle_connect: 0x7f3f3771af90 <= 220-$BBS_HOSTNAME ESMTP Service Ready
[2024-06-30 13:24:57.443] ERROR[2898731]: socket.c:402 bbs_hostname_has_ip: getaddrinfo(pex44.dream-bal.com): Temporary failure in name resolution
[2024-06-30 13:24:57.443] WARNING[2898731]: net_smtp.c:415 fcrdns_check: FCrDNS check failed: pex44.dream-bal.com != 193.32.162.53
[2024-06-30 13:24:57.443] DEBUG[2898731]: net_smtp.c:352 smtp_tarpit: 0x7f3f3771af90: Current number of SMTP failures: 5
[2024-06-30 13:24:57.443] DEBUG[2898731]: node.c:429 bbs_node_safe_sleep: Sleeping on node 5 for 5000 ms
[2024-06-30 13:24:57.480] DEBUG[2898634]: socket.c:1653 bbs_node_poll: Node 14: poll returned 0
[2024-06-30 13:24:57.480] -- Node 14 timed out due to inactivity
[2024-06-30 13:24:57.513] DEBUG[2898720]: net_smtp.c:371 smtp_tarpit: 0x7f3f3c724f90 <= 220-Waiting for service to initialize...
[2024-06-30 13:24:57.514] DEBUG[2898720]: node.c:429 bbs_node_safe_sleep: Sleeping on node 6 for 5000 ms
[2024-06-30 13:24:57.661] DEBUG[2898720]: node.c:441 bbs_node_safe_sleep: Node 6 sleep interrupted: poll returned 1
[2024-06-30 13:24:57.661] DEBUG[2898720]: mod_mail.c:228 mailbox_dispatch_event: Dispatching mailbox event 'Logout'
[2024-06-30 13:24:57.662] DEBUG[2898720]: node.c:2086 bbs_node_exit: Node 6 has ended its SMTP session
[2024-06-30 13:24:57.662] DEBUG[2898720]: node.c:531 node_shutdown: Terminating node 6
[2024-06-30 13:24:57.662] DEBUG[2898720]: node.c:604 node_shutdown: Shutdown pending finalization for node 6
[2024-06-30 13:24:57.662] DEBUG[2898720]: node.c:622 node_free: Node 6 now freed
[2024-06-30 13:24:57.662] == Node 6 has exitedThis is another unhandled case for SSH:
[2024-07-31 11:25:15.106] AUTH[3328343]: net_ssh.c:705 handle_session: Accepting new SSH connection from 61.177.172.140
[2024-07-31 11:25:15.313] DEBUG[3328343]: net_ssh.c:743 handle_session: Fatal key exchange error: kex error : no match for method server host key algo: server [ssh-ed25519], client [ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss]
[2024-07-31 11:25:23.971] AUTH[3328344]: net_ssh.c:705 handle_session: Accepting new SSH connection from 180.101.88.236
[2024-07-31 11:25:24.174] DEBUG[3328344]: net_ssh.c:743 handle_session: Fatal key exchange error: kex error : no match for method server host key algo: server [ssh-ed25519], client [ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss]
[2024-07-31 11:26:02.084] AUTH[3328345]: net_ssh.c:705 handle_session: Accepting new SSH connection from 178.128.94.81
[2024-07-31 11:26:03.681] AUTH[3328345]: auth.c:624 bbs_user_authenticate: Login attempt rejected for user root (wrong password)
[2024-07-31 11:26:03.914] DEBUG[3328345]: net_ssh.c:764 handle_session: Received SSH_MSG_DISCONNECT: 11:Bye ByeReserved usernames /failed negotiation should probably result in automatic blocks.
Comments
You must be