I'm seeing a lot of activity over the last two days with what looks to be a kiddie script. Mostly trying to access several of our servers with the username anna. All failed... in fact I don't think we have a user anna on any of our servers. Meanwhile...
I'm running Sendmail. This pertains to Centos 4 and 5 servers. I'm also running fail2ban on some and Ossec on others. So far, no blocking is being done. When I look at the logs all I find is under messages and here is a sample:
Feb 10 05:23:08 neptune saslauthd[3370]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 05:23:25 neptune saslauthd[3369]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 05:23:58 neptune saslauthd[3370]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 06:56:53 neptune saslauthd[3370]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 06:56:54 neptune saslauthd[3368]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 06:56:55 neptune saslauthd[3370]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 06:56:59 neptune saslauthd[3368]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown]
So, I can't write a rule to block this attack as I can't find any IP address to block. I've looked and googled til my eyes are red and can't find where to set logging in saslauthd or where ever it needs to be set to record the IP address generating these failures. Does anyone have an idea?
Also, some may wish to do a grep 'do_auth' on messages to see if this is happening to you. They sometimes come in rapid succession.
John Hinton