Question plesk_saslauthd - Attack, no IP seen

[Gjimi]

Server operating system version

Debian 10

Plesk version and microupdate number

18.0.59

plesk_saslauthd is under attack, there are thousands of the:

plesk_saslauthd[17936]: No such user 'temp@xyhost.net' in mail authorization database
plesk_saslauthd[17936]: failed mail authentication attempt for user 'temp@xyhost.net' (password len=13)

in the logs.
(just something)

no IP to see no further information.

 

[Kaspar]

The plesk_saslauthd log entires are accompanied by postfix/smtpd log entires. These do contain the IP address from which the login attempt is made.

Looks something like this

 

[Gjimi]

just none! otherwise the IP would have been blocked or Fail2Ban does it, but he can't because no IP can be seen, I wrote.

Apr 11 15:43:39 96 plesk_saslauthd[14952]: No such user 'pravin@mydomain.tld' in mail authorization database
Apr 11 15:43:39 96 plesk_saslauthd[14952]: failed mail authentication attempt for user 'pravin@mydomain.tld' (password len=6)
Apr 11 15:43:42 96 plesk_saslauthd[14952]: No such user 'pravin@mydomain.tld' in mail authorization database
Apr 11 15:43:42 96 plesk_saslauthd[14952]: failed mail authentication attempt for user 'pravin@mydomain.tld' (password len=6)
Apr 11 15:43:42 96 plesk_saslauthd[14952]: No such user 'pravin@mydomain.tld' in mail authorization database
Apr 11 15:43:42 96 plesk_saslauthd[14952]: failed mail authentication attempt for user 'pravin@mydomain.tld' (password len=6)
Apr 11 15:43:43 96 plesk_saslauthd[14952]: No such user 'oracle@mydomain.tld' in mail authorization database
Apr 11 15:43:43 96 plesk_saslauthd[14952]: failed mail authentication attempt for user 'oracle@mydomain.tld' (password len=13)
Apr 11 15:43:45 96 plesk_saslauthd[14952]: No such user 'oracle@mydomain.tld' in mail authorization database
Apr 11 15:43:45 96 plesk_saslauthd[14952]: failed mail authentication attempt for user 'oracle@mydomain.tld' (password len=13)
Apr 11 15:43:45 96 plesk_saslauthd[14952]: No such user 'socios@mydomain.tld' in mail authorization database
Apr 11 15:43:45 96 plesk_saslauthd[14952]: failed mail authentication attempt for user 'socios@mydomain.tld' (password len=9)
Apr 11 15:43:45 96 plesk_saslauthd[14952]: No such user 'socios@mydomain.tld' in mail authorization database
Apr 11 15:43:45 96 plesk_saslauthd[14952]: failed mail authentication attempt for user 'socios@mydomain.tld' (password len=9)
Apr 11 15:43:45 96 plesk_saslauthd[14952]: No such user 'socios@mydomain.tld' in mail authorization database
Apr 11 15:43:45 96 plesk_saslauthd[14952]: failed mail authentication attempt for user 'socios@mydomain.tld' (password len=9)
Apr 11 15:43:50 96 plesk_saslauthd[14952]: No such user 'support@mydomain.tld' in mail authorization database
Apr 11 15:43:50 96 plesk_saslauthd[14952]: failed mail authentication attempt for user 'support@mydomain.tld' (password len=13)
Apr 11 15:43:51 96 plesk_saslauthd[14952]: No such user 'support@mydomain.tld' in mail authorization database
Apr 11 15:43:51 96 plesk_saslauthd[14952]: failed mail authentication attempt for user 'support@mydomain.tld' (password len=13)

and just keep it up, nothing different

 

[Kaspar]

Interesting. I don't know why that is. Best suggestion I can offer is to contact Plesk support to let them investigate the issue.

 

[PAM Baduijn]

Looks like a brute force attack!

Constant ‘failed mail authenticatication’ entries are logged in mail log in Plesk server - Support Cases from Plesk Knowledge Base

Constant ‘failed mail authenticatication’ entries are logged in mail log in Plesk server - Support Cases - Plesk Knowledge Base

www.plesk.com

 

[Gjimi]

Looks like a brute force attack!

Constant ‘failed mail authenticatication’ entries are logged in mail log in Plesk server - Support Cases from Plesk Knowledge Base

Constant ‘failed mail authenticatication’ entries are logged in mail log in Plesk server - Support Cases - Plesk Knowledge Base

www.plesk.com

read before writing.
Yes, but no IP can be seen

 

[PAM Baduijn]

Maybe some logging services are not running

Issue - no entry in /var/log/maillog, messages, secure, etc. (0 B)

Good evening, everyone, We've only just realized that the files are no longer being written to... Several attempts did not lead to success. Maybe someone here has an idea... Product version: Plesk Obsidian 18.0.24.0 OS version: CentOS 7.7.1908 x86_64 Build date: 2020/02/15 00:00 What has...

talk.plesk.com

 

[mar-ek]

Hi!

You can add IP information in the logs for brute force attacks like those with plesk_saslauthd if we vote for this change in Plesk.

Please vote to have better control over such attacks:
Add IP Address and "non-existent mailbox" to plesk_saslauthd Authentication Logs

 

[learning_curve]

The plesk_saslauthd log entires are accompanied by postfix/smtpd log entires. These do contain the IP address from which the login attempt is made.

Looks something like this
View attachment 25899

@Kaspar FWIW, we've added a post to THIS old thread in which, we've posted an example of logged data c/w IP addresses etc. Plesk appears to use saslauthd differently than the OE Ubuntu 24.04 config, so it takes time, to fully comprehend that. AFAWK there's no DFDs or schematics available for the Plesk configuration, which is a shame as that would provide a much clearer understanding for all. @mar-ek You're mentioned in the post that's referred to above.