SMTP.Brute.Force IPS - not working?

[RasmusM]

Dear forum,

I have a FortiGate 300E and a Fortimail 200E, love them both very much - great products!

However I have an IPS Sensor issue regarding the signature "SMTP.Login.Brute.Force".

On the FortiGate we have the IPv4 policy that controls smtp traffic to our spamfilter:

Source: ALL

Destination: SMTP VIP (External IP: X.X.X.X to Mapped IP 10.100.10.9, External Port 25 to Map port 25).

Service: SMTP, SMTPS

Action: Accept

Security Profiles: IPS (with IPS Signature SMTP.Login.Brute.Force, Quarantine 15 Minutes).

On the FortiMail I see around 6000-7000 SMTP Auth Failed attempts every day, some are legit email addresses, but most are random names, which probably is someone trying to brute force login.

Why does the IPS Sensor not stop this?

I have tried custom signatures I found on these forums and put those into the IPS Sensor, with no luck :

F-SBID( --attack_id 6228; --name POP3.Brute.Force; --protocol tcp; --service POP3; --flow from_server,reversed; --pattern " -ERR [AUTH] Password supplied" ; --rate 10,180; --track src_ip; )

F-SBID( --attack_id 2712; --name " SMTP.Brute.Force" ; --pattern " AUTH LOGIN" ; --service SMTP; --no_case; --context header; --rate 10,180; --track src_ip;)

F-SBID( --attack_id 7393;  --revision 1; --name \"SMTP_AUTH_FAILURE01\"; --service SMTP; --protocol tcp; --tcp_flags PA; --pattern \"535 Authentication failed. Restarting authentication process\"; --flow from_server,reversed; --track dst_ip; --rate 10,120; )

Please help! Any input is much appreciated. Thank you.

[hubertzw · Accepted solution]

try this one:

https://forum.fortinet.com/tm.aspx?m=102544

[RasmusM]

Dear Hubertz

I tried with the IPS signatures, it did not work - still getting 5000+ attempts daily. Unsure on how to setup the DoS sensor with SMTP traffic?? Is that possible?

Is it possible to change the rate so it to blocks/quarantines faster?

[Markus]

Hello Rasmus I'm not using Fortimail, but it's similar, just another pattern. This is my working IDP SMTP Brute Force Signature.

F-SBID( --attack_id 2712; --name " SMTP.Brute.Force" ; --pattern "Authentication unsuccessful" ; --service SMTP; --flow from_server,reversed; --no_case; --context header; --rate 2,60; --track src_ip;)

Why do you have two SMTP Signatures? Is this especially because you have Fortimail?

Good luck

[RasmusM]

mgrosni wrote:

Hello Rasmus I'm not using Fortimail, but it's similar, just another pattern. This is my working IDP SMTP Brute Force Signature.

F-SBID( --attack_id 2712; --name " SMTP.Brute.Force" ; --pattern "Authentication unsuccessful" ; --service SMTP; --flow from_server,reversed; --no_case; --context header; --rate 2,60; --track src_ip;)

Why do you have two SMTP Signatures? Is this especially because you have Fortimail?

Good luck

Thank you, I will try this and see how it works.

I used one SMTP signature each try, those I wrote was active one at a time to test if they worked, which they did not.

[mattnotley2004]

Hi Rasmus

We are having the same issue. Have tried all the various custom IPS signatures listed on these forums, etc, with no luck. Our FortiMail returns the pattern "535 5.7.0 authentication failed" when testing through Telnet, but even with this in the FortiGate IPS signature - nothing goes into quarantine.

Did you manage to get this working? Cheers,

Matt.

[jvarouxis]

I have the same problem with 6.4.2  for SMTP .

F-SBID( --attack_id 8641; --name "SMTP.Brute.Force_NEW" ; --pattern "Authentication failed"; --service SMTP; --no_case; --rate 0,5,limit  ; --track dst_ip; --flow reversed;)

not working .

in 6.2 the below was working without a problem .

F-SBID( --attack_id 2712; --name "SMTP.Brute.Force" ; --pattern "Authentication failed"; --service SMTP; --no_case; --context header; --rate 3,60,limit; --track dst_ip;--flow reversed; --log DHCP_CLIENT;)

Any help would be appreciated .

I have opened a ticket for the 6.4.2 and waiting for a solution ..

[g_]

Hello,

I have the same problem with an unit running 6.4.2. Did you receive any answer from support?

[g_]

Hello,

I contacted Fortiguard and they gave me a signature that really works for SMTP. This custom signature works on postfix mail server. Here is the answer from Fortiguard:

F-SBID( --name "SMTP.Login.Brute.Force.custom"; --protocol tcp; --service SMTP; --flow from_server,reversed; --pattern "454 "; --within 4,packet; --track dst_ip; --rate 100,10; )

The "--rate 100,10" part means the signature triggers if failed login to SMTP server 100 times within 10 seconds, please modify the number to fit your requirement.

[jvarouxis]

Hello,

Tested on 6.4.2

i have finally succeeded with Fortigurad to use the below but is still not working as expected .

It blocks at least some but not all as with previous Versions ( 6.2 or 6.0.10).

F-SBID( --name "SMTP.Login.Brute.Force.Custom"; --protocol tcp; --service SMTP; --flow from_server,reversed; --pattern "Authentication failed";--no_case; --context packet; --distance 4,context; --within 40,context; --rate 2,15; --track dst_ip; )

I will update the thread if found smt else .