Hello,
A customer is getting their office IP blacklisted for DoS by SmarterMail.
This happens at least once a week, sometimes more.
Looking at the administrative log I find this:
[2025.02.06] 11:09:11.795 DenialOfService [DenialOfService w.x.y.z] Added IP to IDS block list. Duration: 1799,9369469 seconds, Description: Default DoS rule
So far nothing wrong, but in the administrative log, there is no trace of failed logins from their IP.
However, when looking at IMAP log to see what happened before the blacklisting occured I see a thousand of these:
[2025.02.06] 11:08:14.950 [w.x.y.z][51015382][993] Exception: (PooledTcpItem.cs) Authentication failed, see inner exception.
[2025.02.06] 11:08:14.950 [w.x.y.z][51015382][993] StackTrace: at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
[2025.02.06] 11:08:14.994 [w.x.y.z][14227119][993] Exception: (PooledTcpItem.cs) Authentication failed, see inner exception.
[2025.02.06] 11:08:14.994 [w.x.y.z][14227119][993] StackTrace: at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
[2025.02.06] 11:08:15.066 [w.x.y.z][17945607][993] Exception: (PooledTcpItem.cs) Authentication failed, see inner exception.
[2025.02.06] 11:08:15.066 [w.x.y.z][33600209][993] Exception: (PooledTcpItem.cs) Authentication failed, see inner exception.
[2025.02.06] 11:08:15.066 [w.x.y.z][56148762][993] Exception: (PooledTcpItem.cs) Authentication failed, see inner exception.
[2025.02.06] 11:08:15.066 [w.x.y.z][17945607][993] StackTrace: at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
[2025.02.06] 11:08:15.066 [w.x.y.z][33600209][993] StackTrace: at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
[2025.02.06] 11:08:15.066 [w.x.y.z][56148762][993] StackTrace: at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
[2025.02.06] 11:08:15.066 [w.x.y.z][17917245][993] Exception: (PooledTcpItem.cs) Authentication failed, see inner exception.
[2025.02.06] 11:08:15.067 [w.x.y.z][9135193][993] Exception: (PooledTcpItem.cs) Authentication failed, see inner exception.
[2025.02.06] 11:08:15.067 [w.x.y.z][13736720][993] Exception: (PooledTcpItem.cs) Authentication failed, see inner exception.
[2025.02.06] 11:08:15.067 [w.x.y.z][17917245][993] StackTrace: at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
[2025.02.06] 11:08:15.067 [w.x.y.z][40743218][993] Exception: (PooledTcpItem.cs) Authentication failed, see inner exception.
[2025.02.06] 11:08:15.067 [w.x.y.z][41238720][993] Exception: (PooledTcpItem.cs) Authentication failed, see inner exception.
[2025.02.06] 11:08:15.067 [w.x.y.z][24242040][993] Exception: (PooledTcpItem.cs) Authentication failed, see inner exception.
[2025.02.06] 11:08:15.067 [w.x.y.z][26096497][993] Exception: (PooledTcpItem.cs) Authentication failed, see inner exception.
[2025.02.06] 11:08:15.067 [w.x.y.z][9135193][993] StackTrace: at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
[2025.02.06] 11:08:15.067 [w.x.y.z][13736720][993] StackTrace: at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
[2025.02.06] 11:08:15.067 [w.x.y.z][24242040][993] StackTrace: at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
[2025.02.06] 11:08:15.067 [w.x.y.z][40743218][993] StackTrace: at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
[2025.02.06] 11:08:15.067 [w.x.y.z][41238720][993] StackTrace: at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
I think these exceptions, which I can't really understand what they are about, seems to count as failed login attempts for the DoS rule counters.
My questions about this:
1) What can be causing these exceptions ? It talks about Authentication but there is no authentication failure reported in Administrative log.
2) Our customer claims this happens weekly, that there are no changes on their sides, it fixes itself after a moment. It just happens sometimes and when it happens everyone in the office can't use their mail anymore.
3) If these are errors, but not a wrong password, should these exception really count to increase DoS counters ?
In the meantime I've added the customer office IP in whitelist, but it's not a real solution.
Kind regards.
PS: Tried to open a ticket but the ticket thing on SmarterMail website seems broken, and trying to open a ticket by e-mail is rejected.
PS EDIT: Seems ticket thingy is back now