5 ms·

One thing that was really buried in that article was this bit: > At some point your IP range is bound to be banned, either by one asshole IP neighbor sending s

by gwd 4y ago

One thing that was really buried in that article was this bit: > At some point your IP range is bound to be banned, either by one asshole IP neighbor sending spam, one of your users being pwned [emphasis mine], due to arbitrary reasons, by mistake, it doesn't matter. It's not if, it's when. In other words, at least some of the time, the one of his users' accounts had been compromised, and as a result, his servers were actually sending out spam. But rather than take responsibility for detecting and blocking outgoing spam on his own servers, he's blaming The System for doing exactly what it was meant to do.

cm2187 4y ago
This exact thing happened to me. A test account I created with a weak password that I should have deleted but forgot about got pwned. I have spam detection in place and within an hour I disabled that account. But that was enough to send over 30,000 spam emails, and then your IP reputation is gone for a very long time. The point being that outgoing spam detection won't save you, by the time you are pwned it's too late. My solution is to have a script that scans the mail server log files and aggressively block ips of failed authentication attempts that are not quickly followed by a successful authentication attempt, and get immediate notification when there is a successful authentication attempt from an unexpected country (I think it's not the same bot that scans for vulnerable accounts and sends spam so you have maybe an hour to react). That works well for a small user base.
- jelly 4y ago
  That sounds interesting, could you share the script? I've encountered a few obvious login attempts like that, but since they come from a broad pool of IPs it's not something fail2ban can easily handle without collateral damage.
  - cm2187 4y ago
    It’s parsing smartermail logs which have a kind of funky format and the script quite tied to my setup (I have a central IP ban list because I also momitor non mail related protocols on multiple machines), so not sure it would be very useful to someone else.
ixs 4y ago
What I find so baffling is that these experiences do not match my own at all. I've been running a non-profit ISP for about 23 years with a few friends. We've always been doing this from our own IP Space (/20) in RIPE. Even when we had problems sending spam (compromised user accounts, compromised php websites) and we ended up on a blacklist, we usually could get removed pretty fast. For a few years our mail system would sometimes generate late-bounces, that is accept a mail on the incoming MX only to then figure out that it actually cannot be delivered later on and generate a delivery failure notification mail. Not a good situation. That got us into some trouble here and there. But even that could easily be unblocked again. When we finally managed to set up a new mail infrastructure (2 year project cause it's a hobby) we set up new outgoing SMTP servers which cycle through multiple IP addresses. There was exactly one ISP (Deutsche Telekom T-Online) that was not accepting mail from some of these IPs. One mail and a turnaround time of abour 12hrs later this was fixed. Gmail or Hotmail/live.com/Outlook never had any problems with deliverability. Even with a few users forwarding all their email to their gmail accounts including the spam that slips through our filters. That might mean that a single mail would not be deliverd, but other users never suffered as our outgoing IPs are not being blanket-banned. There's one residential ADSL provider that has a blanket ban on one of our outgoing IPs. There's no way to get that resolved because their mail infrastructure is unmaintained and nobody is reading their mail. Common problem with that one ADSL provider, googling their name shows other people have the same problem. shrug We just use a different outgoing IP for them. No DMARK or DKIM setup at all for outgoing mail. So I wonder, what really makes the difference in experience? Is it just the fact that we have a decent sized IPv4 Network in our name as PI space?
guerby 4y ago
Ipv6 to the rescue with one IPv6 per email account in a /64? :)

by gwd 4y ago

cm2187 4y ago

This exact thing happened to me. A test account I created with a weak password that I should have deleted but forgot about got pwned. I have spam detection in place and within an hour I disabled that account. But that was enough to send over 30,000 spam emails, and then your IP reputation is gone for a very long time. The point being that outgoing spam detection won't save you, by the time you are pwned it's too late. My solution is to have a script that scans the mail server log files and aggressively block ips of failed authentication attempts that are not quickly followed by a successful authentication attempt, and get immediate notification when there is a successful authentication attempt from an unexpected country (I think it's not the same bot that scans for vulnerable accounts and sends spam so you have maybe an hour to react). That works well for a small user base.

jelly 4y ago
That sounds interesting, could you share the script? I've encountered a few obvious login attempts like that, but since they come from a broad pool of IPs it's not something fail2ban can easily handle without collateral damage.
- cm2187 4y ago
  It’s parsing smartermail logs which have a kind of funky format and the script quite tied to my setup (I have a central IP ban list because I also momitor non mail related protocols on multiple machines), so not sure it would be very useful to someone else.

ixs 4y ago

What I find so baffling is that these experiences do not match my own at all. I've been running a non-profit ISP for about 23 years with a few friends. We've always been doing this from our own IP Space (/20) in RIPE. Even when we had problems sending spam (compromised user accounts, compromised php websites) and we ended up on a blacklist, we usually could get removed pretty fast. For a few years our mail system would sometimes generate late-bounces, that is accept a mail on the incoming MX only to then figure out that it actually cannot be delivered later on and generate a delivery failure notification mail. Not a good situation. That got us into some trouble here and there. But even that could easily be unblocked again. When we finally managed to set up a new mail infrastructure (2 year project cause it's a hobby) we set up new outgoing SMTP servers which cycle through multiple IP addresses. There was exactly one ISP (Deutsche Telekom T-Online) that was not accepting mail from some of these IPs. One mail and a turnaround time of abour 12hrs later this was fixed. Gmail or Hotmail/live.com/Outlook never had any problems with deliverability. Even with a few users forwarding all their email to their gmail accounts including the spam that slips through our filters. That might mean that a single mail would not be deliverd, but other users never suffered as our outgoing IPs are not being blanket-banned. There's one residential ADSL provider that has a blanket ban on one of our outgoing IPs. There's no way to get that resolved because their mail infrastructure is unmaintained and nobody is reading their mail. Common problem with that one ADSL provider, googling their name shows other people have the same problem. shrug We just use a different outgoing IP for them. No DMARK or DKIM setup at all for outgoing mail. So I wonder, what really makes the difference in experience? Is it just the fact that we have a decent sized IPv4 Network in our name as PI space?

guerby 4y ago

Ipv6 to the rescue with one IPv6 per email account in a /64? :)