Ttdfjt

Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts.

My password is as strong as a password can be so the chance of brute force winning is infinitesimal. However as a result of the authentication failures, my hosting provider keeps locking the email account.

Is there anything I can do (or that I can ask my hosting provider to do), or am I just screwed until the botnet moves on? Anyone with similar experience who can comment on whether I can expect this to ever end?

A few thoughts:

• Usually my first recommendation would be to pick an extremely strong password. But you allready got that covered.


• If there is two factor authentication available, turn it on. If you are lucky, it might make you an unattractive target and cause the attacker to move on.


• If the account lock out doesn't affect other methods of reading your mail, like via IMAP, you could switch to that to maintain access. (To be honest, I don't know much about the security of IMAP, so you might want to consider that before turning it on.)


• Forwarding the mail somewhere else will also ensure that you can read it even if your account is locked.


• Finally, you can try contacting your email provider. I think your best bet here is to just describe the problem to them, and ask what they can do to help you.

No. That's pretty much the background noise of being on the internet.

From a random server I have with e-mail:

$ sudo grep -c "auth failed" /var/log/mail.log
1109

That's today. It's with fail2ban blocking more than five attempts from the same IP.

Yeah, it's pretty easy to have your official email address forward your emails to a new "burner" email account. Then in the new email account setup, you set your From: field to your official email address. That way mails go out like this.

 From: account-I-always-had@oldserver.com
 Subject: Re: so-and-so
 In-Reply-To: <4735813474834434634@theirmail.com>
 Sender: burneraccount@newserver.com

Or something like that.

Anyway, that lets you keep your identity at the official email address. The attacks on the login server are irrelevant to receiving and forwarding email.

As is evident from the above, your new email address may be obvious from headers so don't set up an autoresponder. Only correspond with people you trust. If this burner email account comes under attack, trash this burner account, setup another one, and tell the official email server to forward to the new burner.

Then, research who you sent mail to in the last 2 days to the last burner account. One of them compromised it. Use one tactic or another to trick them into attacking this or another burner account, that lets you distinguish who exactly did it.

You can set a firewall before your server and with right configuration you can reduce brute force attempts.

You try with your MTA configuration, an example can be Postfix:

smtpd_client_restrictions =
 permit_sasl_authenticated,
 reject_rbl_client zen.spamhaus.org,
 reject_rbl_client bl.spamcop.net,
 reject_rbl_client cbl.abuseat.org,
 reject_rbl_client sbl-xbl.spamhaus.org,
 permit permit_mynetworks,
 permit_inet_interfaces,

tl/dr: This is your hosting company's problem, not yours. You'll have
to contact them to get it fixed. Their security policies shouldn't
lock you out of your own account. They need to do security better.

You already have some answers that I agree heartily with and which cover the technical aspects of this, but I'm throwing in another answer to cover a "business" item. Here you hit on the crux of the issue:

However as a result of the authentication failures, my hosting
provider keeps locking the email account.

In otherwords, the problem isn't your problem. You have done everything you can to secure your account on someone else's mail server - you are using a strong password that can't be brute forced. The underlying issue here is that your hosting provider has implemented a bad security policy. As @vidarlo mentioned, this is just the background noise of the internet. Your hosting provider should know this. Unfortunately their chosen response has the side effect of locking you out of your account.

In essence the combination of your hosting company's choice of security policies and the standard password scanning that happens to every server on the internet has resulted in a denial of service (DoS) of your email. If your email went down because someone attempted an actual DoS of your hosting provider and filled their networks with useless bandwidth, the solution would be quite simple. You wouldn't be asking what you can do to fix the problem - you'd be yelling at your provider and asking them to fix it. After all, the whole point of using a third party email service provider is for them to provide you with a service. If you are not being provided with that service, either because their servers went down, or because their network is crippled by a DoS, or because their security policy is overly zealous and locks you out of your account, then the only real solution is for your hosting provider to fix it and provide you with the service that you are paying them to give you.

Many questions we get here are the result of people security all together.. However, there are plenty more examples of people trying to do security but just doing it wrong. This is one of those. You definitely need to yell at your hosting provider. If they can't provide you with the service you are paying for, then you need to switch to a provider that will (although hopefully it won't be the kind of provider that simply doesn't do security at all).