New Member

Solved

SMTP.Brute.Force IPS - not working?

Forum|Forum|7 years ago
June 21, 2019
9 replies
14099 views

Dear forum,

I have a FortiGate 300E and a Fortimail 200E, love them both very much - great products!

However I have an IPS Sensor issue regarding the signature "SMTP.Login.Brute.Force".

On the FortiGate we have the IPv4 policy that controls smtp traffic to our spamfilter:

Source: ALL

Destination: SMTP VIP (External IP: X.X.X.X to Mapped IP 10.100.10.9, External Port 25 to Map port 25).

Service: SMTP, SMTPS

Action: Accept

Security Profiles: IPS (with IPS Signature SMTP.Login.Brute.Force, Quarantine 15 Minutes).

On the FortiMail I see around 6000-7000 SMTP Auth Failed attempts every day, some are legit email addresses, but most are random names, which probably is someone trying to brute force login.

Why does the IPS Sensor not stop this?

I have tried custom signatures I found on these forums and put those into the IPS Sensor, with no luck :

F-SBID( --attack_id 6228; --name POP3.Brute.Force; --protocol tcp; --service POP3; --flow from_server,reversed; --pattern " -ERR [AUTH] Password supplied" ; --rate 10,180; --track src_ip; )

F-SBID( --attack_id 2712; --name " SMTP.Brute.Force" ; --pattern " AUTH LOGIN" ; --service SMTP; --no_case; --context header; --rate 10,180; --track src_ip;)

F-SBID( --attack_id 7393; --revision 1; --name \"SMTP_AUTH_FAILURE01\"; --service SMTP; --protocol tcp; --tcp_flags PA; --pattern \"535 Authentication failed. Restarting authentication process\"; --flow from_server,reversed; --track dst_ip; --rate 10,120; )

Please help! Any input is much appreciated. Thank you.

Best answer by hubertzw

try this one:

https://forum.fortinet.com/tm.aspx?m=102544

hubertzwAnswer

New Member

try this one:

https://forum.fortinet.com/tm.aspx?m=102544

RasmusMAuthor

New Member

Dear Hubertz

I tried with the IPS signatures, it did not work - still getting 5000+ attempts daily. Unsure on how to setup the DoS sensor with SMTP traffic?? Is that possible?

Is it possible to change the rate so it to blocks/quarantines faster?

Markus

New Member

Hello Rasmus I'm not using Fortimail, but it's similar, just another pattern. This is my working IDP SMTP Brute Force Signature.

F-SBID( --attack_id 2712; --name " SMTP.Brute.Force" ; --pattern "Authentication unsuccessful" ; --service SMTP; --flow from_server,reversed; --no_case; --context header; --rate 2,60; --track src_ip;)

Why do you have two SMTP Signatures? Is this especially because you have Fortimail?

Good luck

RasmusMAuthor

New Member

mgrosni wrote:
Hello Rasmus I'm not using Fortimail, but it's similar, just another pattern. This is my working IDP SMTP Brute Force Signature.
F-SBID( --attack_id 2712; --name " SMTP.Brute.Force" ; --pattern "Authentication unsuccessful" ; --service SMTP; --flow from_server,reversed; --no_case; --context header; --rate 2,60; --track src_ip;)

Why do you have two SMTP Signatures? Is this especially because you have Fortimail?
Good luck

Thank you, I will try this and see how it works.

I used one SMTP signature each try, those I wrote was active one at a time to test if they worked, which they did not.

mattnotley2004

New Member

Hi Rasmus

We are having the same issue. Have tried all the various custom IPS signatures listed on these forums, etc, with no luck. Our FortiMail returns the pattern "535 5.7.0 authentication failed" when testing through Telnet, but even with this in the FortiGate IPS signature - nothing goes into quarantine.

Did you manage to get this working? Cheers,

Matt.

Sign up

Login with SSO

Login to the community

Login with SSO