{"id":238,"date":"2017-03-07T10:51:29","date_gmt":"2017-03-07T02:51:29","guid":{"rendered":"http:\/\/matnet.my\/blog\/?p=238"},"modified":"2017-03-07T10:58:34","modified_gmt":"2017-03-07T02:58:34","slug":"cpanel-server-exim-ddos-attack","status":"publish","type":"post","link":"https:\/\/matnet.my\/blog\/2017\/03\/cpanel-server-exim-ddos-attack\/","title":{"rendered":"Cpanel Server &#8211; Exim DDOS Attack"},"content":{"rendered":"<p><a href=\"https:\/\/matnet.my\/blog\/wp-content\/uploads\/2017\/03\/dos.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft wp-image-242 size-medium\" src=\"https:\/\/matnet.my\/blog\/wp-content\/uploads\/2017\/03\/dos-300x169.jpg\" alt=\"\" width=\"300\" height=\"169\" srcset=\"https:\/\/matnet.my\/blog\/wp-content\/uploads\/2017\/03\/dos-300x169.jpg 300w, https:\/\/matnet.my\/blog\/wp-content\/uploads\/2017\/03\/dos.jpg 590w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a>1. Recently, my server was DDOS. It&#8217;s so frustrated when the server has been suspended by the ISP.<\/p>\n<p>2. From the log, there are too many SMTP connection and confirm one of my client mail has been bomb.<\/p>\n<p>3. This is my first experience facing Exim DDOS. Therefore, all the configs of exim are default and never customized.<\/p>\n<p>4. This is some of my mitigation action<\/p>\n<p>5. Analyze the \/var\/log\/exim_mainlog :<\/p>\n<p>&#8211; There are so many &#8220;Connection from [*.*.*.*] refused: too many connections: 34 Time(s)<br \/>\n&#8211; The IP connected was random from all over the world<br \/>\n&#8211; Identified suspected domain.<\/p>\n<p>6. Check connection : netstat -anp |grep 25<\/p>\n<p>There so many IP established to main server IP address.<\/p>\n<p>7. Backup and suspend\/terminate suspected hosting. Eventhough the hosting account was terminated the DDOS still running since the bomb<br \/>\nalready resolved server IP address.<\/p>\n<p>8. Tuning ACL Option and restart exim. Doesn&#8217;t work, DDOS still coming and coming. Tail -f showed exim_mainlog like an IRC Flood.<\/p>\n<p>9. Finding solution with CSF\/LFD, unfortunately it can&#8217;t handle exim DOS.<\/p>\n<p>10. I&#8217;m lack of idea and stress, then come a simple idea which is replace the IP address with the new one.<\/p>\n<p>11. But it&#8217;s not that simple. I need to change main server IP address that is shared by 400+ domains.<\/p>\n<p>12. Huh~ done changing of 400+ vhosts and changing interface IP address.<\/p>\n<p>13. Cleanup DNS properly with new IP.<\/p>\n<p>14. Restart network and exim.<\/p>\n<p>15. tail exim_mainlog and walla .. alhamdullillah.<\/p>\n<p>16. To prevent further threat i did installed fail2ban and customize with exim dos protection follow by this instruction :<\/p>\n<blockquote data-secret=\"r0Tu4otSkG\" class=\"wp-embedded-content\"><p><a href=\"https:\/\/www.marcus-povey.co.uk\/2013\/07\/31\/blocking-exim-dosmail-bombs\/\">Blocking Exim DOS\/mail bombs<\/a><\/p><\/blockquote>\n<p><iframe loading=\"lazy\" class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" src=\"https:\/\/www.marcus-povey.co.uk\/2013\/07\/31\/blocking-exim-dosmail-bombs\/embed\/#?secret=r0Tu4otSkG\" data-secret=\"r0Tu4otSkG\" width=\"600\" height=\"338\" title=\"&#8220;Blocking Exim DOS\/mail bombs&#8221; &#8212; Marcus Povey\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe><\/p>\n","protected":false},"excerpt":{"rendered":"<p>1. Recently, my server was DDOS. It&#8217;s so frustrated when the server has been suspended by the ISP. 2. From &hellip; <a href=\"https:\/\/matnet.my\/blog\/2017\/03\/cpanel-server-exim-ddos-attack\/\" class=\"more-link\">More <span class=\"screen-reader-text\">Cpanel Server &#8211; Exim DDOS Attack<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,12],"tags":[],"class_list":["post-238","post","type-post","status-publish","format-standard","hentry","category-bsd-nix","category-cpanel-whm","standard"],"_links":{"self":[{"href":"https:\/\/matnet.my\/blog\/wp-json\/wp\/v2\/posts\/238","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/matnet.my\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/matnet.my\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/matnet.my\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/matnet.my\/blog\/wp-json\/wp\/v2\/comments?post=238"}],"version-history":[{"count":2,"href":"https:\/\/matnet.my\/blog\/wp-json\/wp\/v2\/posts\/238\/revisions"}],"predecessor-version":[{"id":243,"href":"https:\/\/matnet.my\/blog\/wp-json\/wp\/v2\/posts\/238\/revisions\/243"}],"wp:attachment":[{"href":"https:\/\/matnet.my\/blog\/wp-json\/wp\/v2\/media?parent=238"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/matnet.my\/blog\/wp-json\/wp\/v2\/categories?post=238"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/matnet.my\/blog\/wp-json\/wp\/v2\/tags?post=238"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}