This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal


Jun 30, 2015, 5:00 PM
50 Posts

Rogue Server

  • Category: Domino Server
  • Platform: Windows
  • Release: 9.0.1
  • Role: Administrator
  • Tags:
  • Replies: 6

is there any way to configure the domino server to ignore connection requests when after X amount of attempts are made to use the domino server as a relay for spam?  i have had instances in the past few months of hosts "demon dialing" our mail server in what looks like either a DOS attack or a spambot attack.  couple excerpts from our log file:

06/30/2015 04:29:02 AM  SMTP Server: host233-207-static.39-88-b.business.telecomitalia.it (88.39.207.233) disconnected. 0 message[s] received
06/30/2015 04:29:02 AM  SMTP Server: host233-207-static.39-88-b.business.telecomitalia.it (88.39.207.233) disconnected. 0 message[s] received
06/30/2015 04:29:03 AM  SMTP Server: host233-207-static.39-88-b.business.telecomitalia.it (88.39.207.233) disconnected. 0 message[s] received
06/30/2015 04:29:03 AM  SMTP Server: host233-207-static.39-88-b.business.telecomitalia.it (88.39.207.233) disconnected. 0 message[s] received
06/30/2015 04:29:03 AM  SMTP Server: host233-207-static.39-88-b.business.telecomitalia.it (88.39.207.233) disconnected. 0 message[s] received
06/30/2015 04:29:03 AM  SMTP Server: host233-207-static.39-88-b.business.telecomitalia.it (88.39.207.233) disconnected. 0 message[s] received

this goes on and on from 2am this morning until I opened up the server console this morning at 6am.

Jul 1, 2015, 5:58 PM
50 Posts
Relay Controls

Thanks for the input Chad.  Currently our Domino server is fairly locked down and have all the relaying controls in place.  I was interested in knowing if there is a mechanism built into Domino similar to what Microsoft has for IIS 7.5 and 8 where if a connection is repeatedly initiated, it will "blacklist" the IP and/or sender and simply ignore/reject any further connection requests.  It's somewhat specialized but it definitely works as the hack attempts on our FTP server went from thousands a day to virtually none.  Of course, it's functionality is governed by how many attempts are made over a predetermined amount of time.

Jul 2, 2015, 12:19 AM
191 Posts
Not aware of anything out of the box for that
You can certainly blacklist a host, but I'm not aware of an out-of-box feature that will provide a threshold after which connections will be blocked. If you want to pursue it, there's an extension manager hook SMTPConnectEMCallback that would allow you to interrogate the incoming connect request, perform your own detection logic, and then handle the request accordingly.
Jul 2, 2015, 3:02 AM
50 Posts
Rogue Server

I wish I had the ability to create what we used to call back in the DOS days as a TSR that would perform the blacklist of this type of hack attempt.  Most of these I'm quite certain originate from a host different than what displays in the connect string and so there is possibly no real way to blacklist the correct entry but at least it would eliminate the attempt in the beginning.  Thanks for taking the time to help....  On to another subject.

 

Jul 11, 2015, 7:02 AM
50 Posts
Fail2Ban

Ben,

That method is exactly what I am trying to find.  It is similar if not identical to what Microsoft made available for IIS 7.5 and what comes natively in IIS 8.  If I had a Linux based installation, I would definitely be working it to see it operate, unfortunately, I'm a 2008R2 platform.  There must be an IBM coder who could place that functionality into the Domino server...  would sure eliminate a lot of hack attacks.


This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal