I run a self-hosted mail server and my logs are getting spammed with asshats trying to break in to my SMTP server (I think; to send spam mail, I presume?).
journalctl | grep "^Aug 11" | grep -E "auth\[[0-9]+\]" | grep failure
yields e.g.
Aug 11 12:21:30 ANONS-SERVER auth[3521]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=postmaster@DOMAIN.COM rhost=175.203.245.102
journalctl | grep "^Aug 11" | grep -E "auth\[[0-9]+\]" | grep failure | wc -l
Today there've been 143 attempts, so far.
This started on August 7th, I get about 150-250 hits a day, usually 2-5 attempts (using postmaster, contact, kontakt, info, uucp, news, and more, usually with domain as a full email address, sometimes without) at once, and then 20-180 minutes pause before it starts all over again.
The perpetrator is using a different IP everytime.
They appear to be in control of a botnet.
The IPs come from mostly BRICS countries.
Comment too long. Click here to view the full text.