Question plesk_saslauthd - Attack, no IP seen

[Gjimi]

Server operating system version

Debian 10

Plesk version and microupdate number

18.0.59

plesk_saslauthd is under attack, there are thousands of the:

plesk_saslauthd[17936]: No such user '[email protected]' in mail authorization database
plesk_saslauthd[17936]: failed mail authentication attempt for user '[email protected]' (password len=13)

in the logs.
(just something)

no IP to see no further information.

 

[Kaspar]

The plesk_saslauthd log entires are accompanied by postfix/smtpd log entires. These do contain the IP address from which the login attempt is made.

Looks something like this

 

[Gjimi]

just none! otherwise the IP would have been blocked or Fail2Ban does it, but he can't because no IP can be seen, I wrote.

Apr 11 15:43:39 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:39 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=6)
Apr 11 15:43:42 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:42 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=6)
Apr 11 15:43:42 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:42 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=6)
Apr 11 15:43:43 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:43 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=13)
Apr 11 15:43:45 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:45 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=13)
Apr 11 15:43:45 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:45 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=9)
Apr 11 15:43:45 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:45 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=9)
Apr 11 15:43:45 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:45 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=9)
Apr 11 15:43:50 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:50 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=13)
Apr 11 15:43:51 96 plesk_saslauthd[14952]: No such user '[email protected]' in mail authorization database
Apr 11 15:43:51 96 plesk_saslauthd[14952]: failed mail authentication attempt for user '[email protected]' (password len=13)

and just keep it up, nothing different

 

[Kaspar]

Interesting. I don't know why that is. Best suggestion I can offer is to contact Plesk support to let them investigate the issue.

 

[PAM Baduijn]

Looks like a brute force attack!

Constant ‘failed mail authenticatication’ entries are logged in mail log in Plesk server - Support Cases from Plesk Knowledge Base

Constant ‘failed mail authenticatication’ entries are logged in mail log in Plesk server - Support Cases - Plesk Knowledge Base

www.plesk.com

 

[Gjimi]

Looks like a brute force attack!

Constant ‘failed mail authenticatication’ entries are logged in mail log in Plesk server - Support Cases from Plesk Knowledge Base

Constant ‘failed mail authenticatication’ entries are logged in mail log in Plesk server - Support Cases - Plesk Knowledge Base

www.plesk.com

read before writing.
Yes, but no IP can be seen

 

[PAM Baduijn]

Maybe some logging services are not running

Issue - no entry in /var/log/maillog, messages, secure, etc. (0 B)

Good evening, everyone, We've only just realized that the files are no longer being written to... Several attempts did not lead to success. Maybe someone here has an idea... Product version: Plesk Obsidian 18.0.24.0 OS version: CentOS 7.7.1908 x86_64 Build date: 2020/02/15 00:00 What has...

talk.plesk.com