SMTP Brute-Force Protection

• SMTP brute-force protection overview
• How to enable and configure SMTP brute-force protection

RdpGuard protects your SMTP server from brute-force attacks.

It monitors mail server logs or unencrypted SMTP traffic and blocks the attacker's IP address when the number of failed login attempts reaches the configured limit.

1. Open RdpGuard Dashboard and click SMTP under Monitored protocols.

   

2. Select Enable SMTP protection, choose a monitoring method and configure it as described below. Then click Save.

   

Monitoring method for SMTP

Choose how RdpGuard detects failed SMTP login attempts:

• Logs - read supported mail server logs.
• Traffic - monitor unencrypted SMTP traffic.

Log-based monitoring

Logs is the recommended default method. It uses fewer resources than Traffic and works with SSL/TLS connections. RdpGuard can also detect usernames when they are available in the supported log records.

SMTP server

Select the mail server software installed on this computer:

• MailEnable
• Kerio Connect
• hMailServer
• MS Exchange
• IBM Domino (HCL Domino)
• Axigen Mail Server
• MDaemon Email Server
• SmarterMail
• E-MailRelay

Log location

Make sure server logging is enabled, then specify where RdpGuard should read the logs:

• Kerio Connect: select the security.log file.
• Axigen: select the security.txt file. Enable security logging with enableSecurityLog = yes in axigen.cfg.
• IBM Domino: select the console.log file.
• MailEnable, hMailServer, MDaemon and SmarterMail: select the server's log folder.
• MS Exchange: select the SMTP receive log folder, or leave the path empty to read the Windows Application Event Log (Event ID 1035).
• E-MailRelay: select the log folder, or leave the path empty to read the Windows Application Event Log. Include client IP addresses in the logs using --log-address or --log-format=address; see the E-MailRelay logging options.

Click Save to apply the settings.

Advanced SMTP settings

When using Logs, click Advanced settings... to choose additional events that count toward IP blocking: failed web admin or webmail logins, username enumeration, relay attempts, spam, DNS blacklist matches and missing reverse DNS records.

Supported events depend on the mail server and its log format. RdpGuard reads these events from the server's logs; it does not run spam filtering or DNS checks itself. Click OK, then Save in SMTP Settings.

Traffic-based monitoring

Traffic detects failed logins in unencrypted SMTP traffic without reading server logs. It uses more resources than Logs and does not detect usernames. It cannot inspect SSL/TLS traffic, including connections upgraded with STARTTLS. Use Logs for encrypted connections.

Select Traffic, then choose a capture method:

• WinPcap/Npcap (recommended) - install WinPcap or Npcap, then click Configure... to select the network adapter to monitor.
• Raw Sockets - may affect network performance and may not work with some firewalls or Windows editions.

SMTP ports

Leave this field empty to monitor port 25, or enter the ports used by your SMTP server. Separate multiple ports with commas, for example 25, 587. Adding a port does not enable monitoring of encrypted traffic on that port.

Click Save to apply the settings. To check for monitoring errors, open View, Show event log in RdpGuard Dashboard.