Recientemente revisé mi registro de correo y encontré muchos mensajes como este (algunos textos cifrados se han truncado):
Feb 23 11:57:42 postfix/smtpd[32451]: initializing the server-side TLS engine
Feb 23 11:57:42 postfix/smtpd[32451]: connect from unknown[176.103.49.30]
Feb 23 11:57:42 postfix/smtpd[32451]: setting up TLS connection from unknown[176.103.49.30]
Feb 23 11:57:42 postfix/smtpd[32451]: unknown[176.103.49.30]: TLS cipher list "ALL:+RC4:@STRENGTH"
Feb 23 11:57:42 postfix/smtpd[32451]: SSL_accept:before/accept initialization
Feb 23 11:57:42 postfix/smtpd[32451]: read from 7FD690FE02C0 [7FD6910804C0] (11 bytes => -1 (0xFFFFFFFFFFFFFFFF))
Feb 23 11:57:42 postfix/smtpd[32451]: read from 7FD690FE02C0 [7FD6910804C0] (11 bytes => 11 (0xB))
(some cipher text)
Feb 23 11:57:42 postfix/smtpd[32451]: 0085 - <SPACES/NULLS>
Feb 23 11:57:42 postfix/smtpd[32451]: SSL_accept:SSLv3 read client hello B
Feb 23 11:57:42 postfix/smtpd[32451]: SSL_accept:SSLv3 write server hello A
Feb 23 11:57:42 postfix/smtpd[32451]: SSL_accept:SSLv3 write certificate A
Feb 23 11:57:42 postfix/smtpd[32451]: SSL_accept:SSLv3 write server done A
Feb 23 11:57:42 postfix/smtpd[32451]: write to 7FD690FE02C0 [7FD69108DE80] (1030 bytes => 1030 (0x406))
(some cipher text)
Feb 23 11:57:42 postfix/smtpd[32451]: 0403 - <SPACES/NULLS>
Feb 23 11:57:42 postfix/smtpd[32451]: SSL_accept:SSLv3 flush data
Feb 23 11:57:42 postfix/smtpd[32451]: read from 7FD690FE02C0 [7FD6910804C3] (5 bytes => -1 (0xFFFFFFFFFFFFFFFF))
Feb 23 11:57:42 postfix/smtpd[32451]: read from 7FD690FE02C0 [7FD6910804C3] (5 bytes => 5 (0x5))
Feb 23 11:57:42 postfix/smtpd[32451]: 0000 16 03 03 01 06 .....
Feb 23 11:57:42 postfix/smtpd[32451]: read from 7FD690FE02C0 [7FD6910804C8] (262 bytes => -1 (0xFFFFFFFFFFFFFFFF))
Feb 23 11:57:42 postfix/smtpd[32451]: read from 7FD690FE02C0 [7FD6910804C8] (262 bytes => 262 (0x106))
(some cipher text)
Feb 23 11:57:42 postfix/smtpd[32451]: SSL_accept:SSLv3 read client key exchange A
Feb 23 11:57:42 postfix/smtpd[32451]: read from 7FD690FE02C0 [7FD6910804C3] (5 bytes => -1 (0xFFFFFFFFFFFFFFFF))
Feb 23 11:57:42 postfix/smtpd[32451]: read from 7FD690FE02C0 [7FD6910804C3] (5 bytes => 5 (0x5))
Feb 23 11:57:42 postfix/smtpd[32451]: SSL_accept:SSLv3 read finished A
Feb 23 11:57:42 postfix/smtpd[32451]: SSL_accept:SSLv3 write change cipher spec A
Feb 23 11:57:42 postfix/smtpd[32451]: SSL_accept:SSLv3 write finished A
Feb 23 11:57:42 postfix/smtpd[32451]: write to 7FD690FE02C0 [7FD69108DE80] (47 bytes => 47 (0x2F))
(some cipher text)
Feb 23 11:57:42 postfix/smtpd[32451]: SSL_accept:SSLv3 flush data
Feb 23 11:57:42 postfix/smtpd[32451]: Anonymous TLS connection established from unknown[176.103.49.30]: TLSv1.2 with cipher RC4-SHA (128/128 bits)
Feb 23 11:57:43 postfix/smtpd[32451]: Read 16 chars: EHLO localhost??
Feb 23 11:57:43 postfix/smtpd[32451]: Write 158 chars: 250-mail.(domain).com??250-PIPELINING??250
Feb 23 11:57:43 postfix/smtpd[32451]: write to 7FD690FE02C0 [7FD691088A13] (183 bytes => 183 (0xB7))
(some cipher text)
Feb 23 11:57:43 postfix/smtpd[32451]: Read 45 chars: AUTH PLAIN AGFkbWluQGZpcGljay5jb20Ad2lsb
Feb 23 11:57:45 postfix/smtpd[32451]: warning: unknown[176.103.49.30]: SASL PLAIN authentication failed:
Feb 23 11:57:45 postfix/smtpd[32451]: Write 42 chars: 435 4.7.8 Error: authentication failed:
Feb 23 11:57:45 postfix/smtpd[32451]: write to 7FD690FE02C0 [7FD691088A13] (67 bytes => 67 (0x43))
(some cipher text)
Feb 23 11:57:45 postfix/smtpd[32451]: Read 3 chars: *??
Feb 23 11:57:45 postfix/smtpd[32451]: Write 41 chars: 402 4.5.2 Error: command not recognized?
Feb 23 11:57:45 postfix/smtpd[32451]: write to 7FD690FE02C0 [7FD691088A13] (66 bytes => 66 (0x42))
Feb 23 11:57:45 postfix/smtpd[32451]: 0000 17 03 03 00 1a .....
Feb 23 11:57:45 postfix/smtpd[32451]: read from 7FD690FE02C0 [7FD6910804C8] (26 bytes => -1 (0xFFFFFFFFFFFFFFFF))
Feb 23 11:57:45 postfix/smtpd[32451]: read from 7FD690FE02C0 [7FD6910804C8] (26 bytes => 26 (0x1A))
¿Cuál es el significado de estos mensajes? ¿Alguien intentó hackear mi cuenta de correo electrónico?
Además, ¿cuál es la acción adecuada para esta situación?
Respuesta1
Parece que alguien puede estar intentando forzar su contraseña por fuerza bruta. Intente realizar una decodificación base64 de los valores después de AUTH PLAIN. Estos deberían permitirle determinar si están utilizando credenciales válidas.
Es probable que estén iniciando la conexión TLS para obtener acceso al comando AUTH, que normalmente no está disponible en conexiones no cifradas.
Sería apropiado incluir la IP de origen en la lista negra del firewall durante un período de tiempo. Existen herramientas fail2banque pueden monitorear sus registros y tomar medidas automáticamente.
Si no necesita acceso externo (Internet) al servidor de correo, es posible que desee desactivar StartTLS y/o AUTH. Solo habilito AUTH en el puerto de envío (587), aunque no sé cómo configurarlo en Postfix.