Self-hosted email is the hardest it's ever been, but also the easiest

Re:Self-hosted email is the hardest it's ever been, but also... by cm2187 on Monday September 05, 2022 @04:09AM (#32721726)

This exact thing happened to me. A test account I created with a weak password that I should have deleted but forgot about got pwned. I have spam detection in place and within an hour I disabled that account. But that was enough to send over 30,000 spam emails, and then your IP reputation is gone for a very long time.

The point being that outgoing spam detection won't save you, by the time you are pwned it's too late.

My solution is to have a script that scans the mail server log files and aggressively block ips of failed authentication attempts that are not quickly followed by a successful authentication attempt, and get immediate notification when there is a successful authentication attempt from an unexpected country (I think it's not the same bot that scans for vulnerable accounts and sends spam so you have maybe an hour to react).

That works well for a small user base.

[ Parent | on HN ]

Re:Self-hosted email is the hardest it's ever been, but also... by jelly on Monday September 05, 2022 @05:17AM (#32722138)

That sounds interesting, could you share the script?

I've encountered a few obvious login attempts like that, but since they come from a broad pool of IPs it's not something fail2ban can easily handle without collateral damage.

[ Parent | on HN ]

Re:Self-hosted email is the hardest it's ever been, but also... by cm2187 on Monday September 05, 2022 @07:00AM (#32722944)

It’s parsing smartermail logs which have a kind of funky format and the script quite tied to my setup (I have a central IP ban list because I also momitor non mail related protocols on multiple machines), so not sure it would be very useful to someone else.

[ Parent | on HN ]