DoS Filter Not Working

[awsgnalla]

Hi,

We're trying to figure-out on Zimbra DOS filter is not suspending IP's. It'll lock the account but IP is not suspended.
I have the Zimbra DOS settings set-up below:

zimbraHttpDosFilterDelayMillis 20
zimbraHttpDosFilterMaxRequestsPerSec 250
zimbraInvalidLoginFilterDelayInMinBetwnReqBeforeReinstating 30
zimbraInvalidLoginFilterMaxFailedLogin 5
zimbraInvalidLoginFilterReinstateIpTaskIntervalInMin 5

Failed login policy was set to 10 under Zimbra Admin Console >Home > Configure > Class of Service > Advanced > Failed Login Policy

This is a test Zimbra server and I made the bad tries login by connecting to a Windows VM that is on a different network.

Logs:

[zimbra@mail ~]$ cat ~/log/mailbox.log | grep "suspended, for repeated failed login."
[zimbra@mail ~]$ cat ~/log/mailbox.log | grep "authentication failed"
2020-08-17 08:59:43,275 INFO [qtp1286783232-314:http://localhost:8080/service/soap/AuthRequest] [name=aws@domain.com;oip=103.15.29.26;ua=zclient/8.8.11_GA_3799;soapId=7dc5890e;] SoapEngine - handler exception: authentication failed for [aws@domain.com], invalid password
2020-08-17 08:59:47,578 INFO [qtp1286783232-315:http://localhost:8080/service/soap/AuthRequest] [name=aws@domain.com;oip=103.15.29.26;ua=zclient/8.8.11_GA_3799;soapId=7dc58910;] SoapEngine - handler exception: authentication failed for [aws@domain.com], invalid password
2020-08-17 08:59:54,345 INFO [qtp1286783232-314:http://localhost:8080/service/soap/AuthRequest] [name=aws@domain.com;oip=103.15.29.26;ua=zclient/8.8.11_GA_3799;soapId=7dc58912;] SoapEngine - handler exception: authentication failed for [aws@domain.com], invalid password
2020-08-17 08:59:59,822 INFO [qtp1286783232-315:http://localhost:8080/service/soap/AuthRequest] [name=aws@domain.com;oip=103.15.29.26;ua=zclient/8.8.11_GA_3799;soapId=7dc58914;] SoapEngine - handler exception: authentication failed for [aws@domain.com], invalid password
2020-08-17 09:00:04,141 INFO [qtp1286783232-314:http://localhost:8080/service/soap/AuthRequest] [name=aws@domain.com;oip=103.15.29.26;ua=zclient/8.8.11_GA_3799;soapId=7dc58917;] SoapEngine - handler exception: authentication failed for [aws@domain.com], invalid password
2020-08-17 09:00:08,427 INFO [qtp1286783232-311:http://localhost:8080/service/soap/AuthRequest] [name=aws@domain.com;oip=103.15.29.26;ua=zclient/8.8.11_GA_3799;soapId=7dc5891a;] SoapEngine - handler exception: authentication failed for [aws@domain.com], invalid password
2020-08-17 09:00:13,321 INFO [qtp1286783232-304:http://localhost:8080/service/soap/AuthRequest] [name=aws@domain.com;oip=103.15.29.26;ua=zclient/8.8.11_GA_3799;soapId=7dc5891c;] SoapEngine - handler exception: authentication failed for [aws@domain.com], invalid password
2020-08-17 09:00:18,414 INFO [qtp1286783232-250:http://localhost:8080/service/soap/AuthRequest] [name=aws@domain.com;oip=103.15.29.26;ua=zclient/8.8.11_GA_3799;soapId=7dc5891e;] SoapEngine - handler exception: authentication failed for [aws@domain.com], invalid password
2020-08-17 09:00:22,412 INFO [qtp1286783232-304:http://localhost:8080/service/soap/AuthRequest] [name=aws@domain.com;oip=103.15.29.26;ua=zclient/8.8.11_GA_3799;soapId=7dc58920;] SoapEngine - handler exception: authentication failed for [aws@domain.com], invalid password
2020-08-17 09:00:27,774 INFO [qtp1286783232-18:http://localhost:8080/service/soap/AuthRequest] [name=aws@domain.com;oip=103.15.29.26;ua=zclient/8.8.11_GA_3799;soapId=7dc58922;] SoapEngine - handler exception: authentication failed for [aws@domain.com], invalid password
2020-08-17 09:00:33,078 INFO [qtp1286783232-304:http://localhost:8080/service/soap/AuthRequest] [name=aws@domain.com;oip=103.15.29.26;ua=zclient/8.8.11_GA_3799;soapId=7dc58924;] SoapEngine - handler exception: authentication failed for [aws@domain.com], account lockout


Any insight or help is very much appreciated.

Thanks,

Gio

[rcardozo1987]

Hey Gio, how are you?

I use DDoS protection here and it works pretty well. Are you sure you are hitting zimbra with the real forwarded IP, without modifying it trought your proxies?

Here are some variables to control this feature:

Code: Select all

zmprov gcf zimbraInvalidLoginFilterMaxFailedLogin
zimbraInvalidLoginFilterMaxFailedLogin: 50000

zmprov gcf zimbraInvalidLoginFilterReinstateIpTaskIntervalInMin
zimbraInvalidLoginFilterReinstateIpTaskIntervalInMin: 1

zmprov gcf zimbraInvalidLoginFilterDelayInMinBetwnReqBeforeReinstating
zimbraInvalidLoginFilterDelayInMinBetwnReqBeforeReinstating: 5

[awsgnalla]

Hi,

Thank you for your response.
I'm not sure about what you mean about this:
"Are you sure you are hitting zimbra with the real forwarded IP, without modifying it trought your proxies?"

How do I get to check it?

Thanks,

Gio

[rcardozo1987]

Hi,

Thank you for your response.
I'm not sure about what you mean about this:
"Are you sure you are hitting zimbra with the real forwarded IP, without modifying it trought your proxies?"

How do I get to check it?

Thanks,

Gio

If you look inside your mailbox.log, can you see an AuthRequest with the original request IP address or just with your proxy IP?

[awsgnalla]

Hi,

Thank you for your response.
Yes. In mailbox.log, it only shows the Zimbra proxy IP and not the originating IP used in the bad tries login.


Thanks,

Gio

[awsgnalla]

Hi,

I followed the settings that you provided as below:

zmprov gcf zimbraInvalidLoginFilterMaxFailedLogin
zimbraInvalidLoginFilterMaxFailedLogin: 50000

zmprov gcf zimbraInvalidLoginFilterReinstateIpTaskIntervalInMin
zimbraInvalidLoginFilterReinstateIpTaskIntervalInMin: 1

zmprov gcf zimbraInvalidLoginFilterDelayInMinBetwnReqBeforeReinstating
zimbraInvalidLoginFilterDelayInMinBetwnReqBeforeReinstating: 5

Still ,mailbox.logs shows not suspending IP's. Even if I lower the value zimbraInvalidLoginFilterMaxFailedLogin. It'll only lock the account and it won't suspend an IP
when making bad tries login.

This our Zimbra test server version:
Release 8.8.11_GA_3737.RHEL6_64_20181207111719 RHEL6_64 FOSS edition, Patch 8.8.11_P4.

Thanks,

Gio