Dictionary Attacks on mail servers

[plasticpig]

Currently seem to have someone running a dictionary attack on our SMTP Server. I am guessing its spammers having a go. The server is setup for relaying but only for specified domains and obviously it requires authentication. They seem to be persistent bugers though. I blocked the the IP addresses they were using and 5 new IP addresses have appeared. Is it worth reporting to anyone considering the IP addresses seem to be eastern european or korean?

[SneakyNeil]

The machines may well be zombies but can't hurt to fire off an email to the whois contacts & ISP anyway. Most of my SSH servers see quite a bit of random action as well but 5 simultaneous IPs over a long period of time sounds quite concerted! I've heard of auto-blocking scripts, delay scripts etc. to combat this kind of stuff but its not something I've done myself...

[ThePassenger]

As above, you can deploy auto blocking scripts and delays, but you will see very little action taken by ISP's about this sort of thing. I'm afraid the only real action you can take is send a message to everyone hanging off the server to change their mail passwords to something nice and long, just on the off chance they manage to get in.

I'd also stop the proxying/relaying that's what brought the spammer/script kiddie to your door in the first place... more are likley to turn up soon or later.