Account lockout costantly

[Fr0ggy]

Hello,
I need some help ...
In the last weeks I'm having costanlty problems with account lockouts,a least 5-6 a day
The ip are always from the local network

2012-04-09 14:17:45,336 INFO  [btpool0-15871] [oip=192.168.1.33;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx@xxx.xxx; error=account lockout due to too many failed logins;
2012-04-09 15:55:24,596 INFO  [btpool0-15971] [oip=192.168.1.185;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx@xxx.xxx; error=account lockout due to too many failed logins;
2012-04-09 16:08:19,754 INFO  [btpool0-15967] [oip=192.168.1.136;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx@xxx.xxx; error=account lockout due to too many failed logins;
2012-04-09 18:36:36,752 INFO  [btpool0-16038] [oip=192.168.1.125;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx@xxx.xxx; error=account lockout due to too many failed logins;
2012-04-10 08:06:26,773 INFO  [btpool0-16121] [oip=192.168.1.33;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx@xxx.xxx; error=account lockout due to too many failed logins;
2012-04-10 12:35:45,248 INFO  [btpool0-16358] [oip=192.168.1.125;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx@xxx.xxx; error=account lockout due to too many failed logins;

2012-04-09 16:09:06,224 WARN  [btpool0-15969] [oip=192.168.104.136;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx; protocol=soap; error=authentication failed for xxxxx, account lockout;
2012-04-09 18:36:46,548 WARN  [btpool0-16038] [oip=192.168.103.125;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx; protocol=soap; error=authentication failed for xxx, account lockout;

2012-04-09 16:08:58,986 INFO  [btpool0-15981] [oip=192.168.1.136;ua=zclient/5.0.6_GA_2313.RHEL5;] SoapEngine - handler exception: authentication failed for xxxx, account lockout
2012-04-09 16:09:06,337 INFO  [btpool0-15969] [oip=192.168.1.125;ua=zclient/5.0.6_GA_2313.RHEL5;] SoapEngine - handler exception: authentication failed for xxxx, account lockout

Where I can find additional info about the cause of this and what it can be?
Thank you




I'm using Release 5.0.6_GA_2313.RHEL5_20080522104341 CentOS5 FOSS edition

[phoenix]

Hello,
I need some help ...
In the last weeks I'm having costanlty problems with account lockouts,a least 5-6 a day
The ip are always from the local network

2012-04-09 14:17:45,336 INFO  [btpool0-15871] [oip=192.168.1.33;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx@xxx.xxx; error=account lockout due to too many failed logins;
2012-04-09 15:55:24,596 INFO  [btpool0-15971] [oip=192.168.1.185;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx@xxx.xxx; error=account lockout due to too many failed logins;
2012-04-09 16:08:19,754 INFO  [btpool0-15967] [oip=192.168.1.136;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx@xxx.xxx; error=account lockout due to too many failed logins;
2012-04-09 18:36:36,752 INFO  [btpool0-16038] [oip=192.168.1.125;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx@xxx.xxx; error=account lockout due to too many failed logins;
2012-04-10 08:06:26,773 INFO  [btpool0-16121] [oip=192.168.1.33;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx@xxx.xxx; error=account lockout due to too many failed logins;
2012-04-10 12:35:45,248 INFO  [btpool0-16358] [oip=192.168.1.125;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx@xxx.xxx; error=account lockout due to too many failed logins;

2012-04-09 16:09:06,224 WARN  [btpool0-15969] [oip=192.168.104.136;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx; protocol=soap; error=authentication failed for xxxxx, account lockout;
2012-04-09 18:36:46,548 WARN  [btpool0-16038] [oip=192.168.103.125;ua=zclient/5.0.6_GA_2313.RHEL5;] security - cmd=Auth; account=xxx; protocol=soap; error=authentication failed for xxx, account lockout;

2012-04-09 16:08:58,986 INFO  [btpool0-15981] [oip=192.168.1.136;ua=zclient/5.0.6_GA_2313.RHEL5;] SoapEngine - handler exception: authentication failed for xxxx, account lockout
2012-04-09 16:09:06,337 INFO  [btpool0-15969] [oip=192.168.1.125;ua=zclient/5.0.6_GA_2313.RHEL5;] SoapEngine - handler exception: authentication failed for xxxx, account lockout

Where I can find additional info about the cause of this and what it can be?

It tells you in the error messages why the account is locked (see the red highlighted text ib your log sample I've quoted above), as for the cause I'd guess you either have a user that's trying to login to those accounts repeatedly or there's a compromised machine at that LAN IP address - you need to fix that.

[Fr0ggy]

Thank you for the reply phoenix,
I have found in the logs some bruteforce attacks trough the pop3 port.
Is there a way to drop incoming connections from blacklisted ip adresses with rbls?
I have blocked some ranges with iptables but it is not efficient.

Thank you

[jrmacarthur]

If it's an option for you, do what I do. Firewall pop and imap completely.. Make people use pop3s and imaps.

[Fr0ggy]

If it's an option for you, do what I do. Firewall pop and imap completely.. Make people use pop3s and imaps.

Unfortunately I cannot firewall those ports because of the expired certificates, I'll search for another solution