SMTP being attacked

hcl-bot · March 7, 2005, 4:01pm

What appears to be happenning is hundreds of different IP addresses are all trying to connect to my Notes server from the internet at the same time. (DoS attack?) They each a SMTP connection. But there is no activity, and the port stays open until my server closes it.

The DSNBL function blocks incoming mail from being delivered. But it does not stop the connection themselves.

Any ideas on how to either :

a) stop the connection from connecting in the first place

b) terminate the connection quickly once it does.

Thanks

hcl-bot · March 8, 2005, 7:31am

Subject: SMTP being attacked

You can stop certain ip addresses from connecting, by using the Inbound Connnection Controls section of the SMTP Inbound Controls tab of the configuration document. But I don’t think that would be very useful here, given the numbers of ip addresses that were connecting to you.

I think that after a connecting host is determined to be on a blacklist, the connection is terminated by the Domino server. I’ve tested this, and on my server it takes less than a second to go from ‘connection accepted’ to ‘disconnected’ when the connecting server is blacklisted:

005 13:24:16.99 [10860:00007-04101] SMTP CIServ Listen> Connection Accepted on Port 25 for Session 0D67000A

03/08/2005 13:24:17 SMTP Server [10860:00012-07176] State change from Greeting to Greeting

03/08/2005 13:24:17 SMTP Server [10860:00012-07176] Processing in Greeting state

03/08/2005 13:24:17 SMTP Server: Remote host 192.203.178.107 (sbl.crynwr.com) found in blacklist at sbl-xbl.spamhaus.org

03/08/2005 13:24:17 SMTP Server: Message from 192.203.178.107 (sbl.crynwr.com) rejected by DNS blacklist filter

03/08/2005 13:24:17 SMTP Server [10860:00012-07176] State change from Greeting to Connected

03/08/2005 13:24:17 SMTP Server: sbl.crynwr.com (192.203.178.107) connected

03/08/2005 13:24:17 SMTP Server [10860:00012-07176] Processing in Connected state

03/08/2005 13:24:17 SMTP Server [10860:00012-07176] HELO command received

03/08/2005 13:24:17 SMTP Server [10860:00012-07176] Processing in Connected state

03/08/2005 13:24:17 SMTP Server [10860:00012-07176] MAIL command received

03/08/2005 13:24:17 SMTP Server [10860:00012-07176] 554 .

03/08/2005 13:24:17 SMTP Server: sbl.crynwr.com (192.203.178.107) disconnected. 0 message[s] received

So those connections should be dropped rather quickly.

What timeout value does the TCPIP port have?

hcl-bot · March 8, 2005, 8:46am

Subject: RE: SMTP being attacked

The problem with inbound connection control is that you have to list the IP addresses. So as you say, that doesn’t work for me here.

I am pretty sure the DNSBL function is for message delivery only. Even looking at your log above, you notice that the only refernece to the blacklist is “message rejected by DNS blacklist filter.” If connections themselves were blocked then it would never have a chance to get the point to attempt to deliver the mail.

(What calue does your TCPIP port have?)

Not sure.

There was already a setting in Notes.ini:

TCPIP_TcpConnectTimeout=0,5

But I’m not sure what this does yet.

I also added a setting to notes.ini

Server_Session_Timeout=1

That should dump an inactive connection after 1 minute. But this didn’t seem to help me.

After more research, I believe I was in the middle of a DDos SYN Flood attack.

What I did:

changed a registry entry for DWORD synfloodprotection = 1
installed and ran a program called “harden-it”

shortly after this, the problem seemed to stop. using a packet sniffer, I think the connections are still coming in, but i have contained them. but i’m not totally sure. perhaps the volume of the connections has just went down enough to level out my server.

I hope I have this licked, but I’m not so sure.

Thanks

hcl-bot · March 9, 2005, 12:32pm

Subject: DNSBL…

Well, glad you got that solved, for the moment. Did you consider filing a police report? Don’t know what kind of website you represent, but that may be interesting to try.

What DNSBL does, is checking if the connecting host is in a blacklist, during the SMTP conversation. As soon as it’s determined that the connected host is blacklisted, the server issues a 554 and disconnects. So, yes, there is a brief period in which the two are connected. But the connection is terminated before the sending server can even issue the DATA command, imho: