Skip to main content

Cphulk Account Protection Question

ljj3
Hi... I run a VPS and I'm seeing a LOT of attacks against Dovecot SMTP - hundreds of them. Usually they come from "some random IP address" to a user@client.com, where client.com is a site hosted on our server. However client has their own email server - their mail never touches my machine. Usually CSF will kill each attempt after a couple of tries (to the nonexistent email account) - but they come right back with a new IP - hundreds of times a minute. Cphulk should help but I have a question. What "account" is it attempting to protect? The client.com account on my server? Or user@client.com - which does not exist on my server so I don't see how it would handle these connection attempts... Also for this type of attack is there something else other than CSF/CPhulk I should be doing, as they tend to slow the server down and have cause hangs.... Thank you much, - Lou

Comments

1 comment

Date Votes
  • cPanelMichael
    Hello :) Brute force attempts are attempts for username/password combinations. It's possible for attempts on domain names that do not even exist, as it's all about what the attacker is using during the login attempt. cPHulk will lock out the IP address making the brute force attempt, or the email account itself, depending on how you have configured it. CSF should block the offending IP addresses, but you may want to consult with a system administrator if the attacks require additional custom firewall rules. Thank you.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post