My server is being attacked

Use this forum if you have installed hMailServer and want to ask a question related to a production release of hMailServer. Before posting, please read the troubleshooting guide. A large part of all reported issues are already described in detail here.
Post Reply
DScruton
New user
New user
Posts: 1
Joined: 2010-02-17 05:40

My server is being attacked

Post by DScruton » 2010-02-17 05:52

I am setting up a server and I was loking at the logs and noticed that someone was attacking me from 71.68.116.31 for 15 minutes today (52 pages of messages in log file). What do I need to do to block this address? I've nticed other addresses as well.

User avatar
mattg
Moderator
Moderator
Posts: 20788
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: My server is being attacked

Post by mattg » 2010-02-17 06:37

Do the logs show connections or rejections?

If the logs show rejections, all I can say is 'welcome to the internet'. If the logs show some successful connections we had better fix that.
Perhaps you can block that specific IP at your firewall....
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

User avatar
Rainer
Normal user
Normal user
Posts: 166
Joined: 2007-06-21 13:40
Location: Zweibrücken - Germany

Re: My server is being attacked

Post by Rainer » 2010-02-17 10:07

Hello DScruton, or block the IP by an HMS-IP-Range.
If You want, use the expire-option!

Kind Regards :)
Rainer Noa

Tezcatlipoca
Senior user
Senior user
Posts: 309
Joined: 2009-07-21 12:33

Re: My server is being attacked

Post by Tezcatlipoca » 2010-02-17 12:40

I run the IT department of a UK marketing company. Given our very public face, our servers get attacked all the time - at least two or three times a week - by bots trying to brute force their way into our accounts.

For me, upgrading to the latest hMail and switching on the Auto-Ban function has pretty much sovled the problem. I still get enough logs to take remedial action, but because the offending IP is banned after 5 attempts my log isn't flooded with entries and our bandwidth doesn't take a serious hit.

Post Reply