Black-list error message

Question asked by Rod Strumbel - 4/9/2021 at 1:32 PM

Unanswered

Maybe I'm just not finding it... but.. I don't see any sort of logging for what has come and gone in the Temporary Black list... is there ???

I see in my SMTP logs that a user was receiving:

"421 Server is busy, try again later." response returned.

IP is blacklisted

But, that IP is NOT in our BlackList so I have to assume that message was coming from the Temp BlackList due to some IDS violation (which also does not seem to log anything anywhere).

The same account successfully connects from 2 other IP addresses all day long.

Is there somewhere a limit on the number of simultaneous sessions each account can have ?

Thanks.

5 Replies

Reply to Thread

Rod Strumbel Replied

4/9/2021 at 1:57 PM

I'm still interested in more information on the questions above, but I've found the cause of my issue. Someone setup a blacklist range in our server that covered 3 class C's (instead of 1) and this clients IP was in the middle of it.

If you SEARCHED for the IP in question though, the search DID NOT find it in the blacklist eventhough it was part of a block of IPs. So... that sounds to me like a bug.

Rod

Sébastien Riccio Replied

4/10/2021 at 10:50 AM

We also have sometimes some strange IP blacklisting due to IDS, without any clue as why it was blacklisted. The only workaround we found for this is to whitelist the affected IP.

After we opened a ticket about it, there was supposed to be a more comprehensive and complete IDS log introduced after the MAPI release was completed, but it seems it was silently dismissed.

Last update about it was in July 2020

Good afternoon, I hope this email finds you well. Just touching base this afternoon to let you know development has added a task to address your suggestions regarding adding the IDS reasoning to the Administrative logs, or at the very least allow seeing the failure in the Normal logs rather than Detailed. Now that this is on their list I'll go ahead and close out this ticket. Thanks for your time Sebastien, and have a great rest of your week.

and

Good morning, I hope you are doing well today. I've received word this has been officially added to development's list. As such, I'll go ahead and close out this ticket today for the time being. Once we receive confirmation this has been resolved I will reopen the ticket to provide you the build number you can find the fix in. Please let me know if you have any outstanding questions when you have a moment. Thanks for your time, and have a great rest of your week!

then the ticket was closed.

Nothing new since :/

EDIT: I see that you found the source of your issue and this is great. I still think we miss a dedicated log about IDS blacklisting though.

Kind regards.

Sébastien Riccio

System & Network Admin

https://swisscenter.com

Kyle Kerst Replied

4/21/2021 at 4:57 PM

Employee Post

Sebastien/Rod - This request is still on our list at this time - but has not received an update we can share just yet. With that being said, you can find a log entry like the one below in your Administrative logs in each scenario that generates an IDS block:

[2021.04.21] 11:03:43.375 [BruteForceBySession] [Smtp] Added xxx.xxx.xxx.xxx to IDS block list. Duration: 7200 seconds, Description: Password Brute-Force by IP

If you find one of your end users is being blocked regularly, you can start by searching the Administrative logs for an entry like this one, then look in and around there to see what authentication attempts or other actions might have caused it. I hope this helps!

Kyle Kerst

Lead Internal Network/System Administrator

SmarterTools Inc.

smartertools.com

Rod Strumbel Replied

4/22/2021 at 6:26 AM

Thank you Kyle, that will be useful

Kyle Kerst Replied

4/22/2021 at 3:53 PM

Employee Post

You're very welcome Rod! I've also sent you both a DM with a debug log ID you can use for count logging on the IDS system which should help track down particularly tricky scenarios. Have a good one!

Kyle Kerst

Lead Internal Network/System Administrator

SmarterTools Inc.

smartertools.com

Back to Community Threads

Please leave this box unchecked

Reply to Thread

Enter the verification text