zondag 14 februari 2016

HMailServer: block autobanned ip addresses permanently

Many people seem to try logging into my HMailserver, without success. The attempts are eventually blocked by the servers autoban functionality, but it's really annoying to see so many red autobanned ip-ranges showing up in my ip-configuration screen (moreover, it's slowing that screen down), so in case of many login-attempts I wanted to block such an ip-range for a longer period, say 30 days.

Because the blocked ipranges are stored in a MySQL database, this can be done using a MySQL-server scheduled event:

use [your hmaildatabase];
delimiter |

CREATE EVENT Block_Email_Hackers
ON SCHEDULE EVERY 3 HOUR STARTS '[startdate]'
COMMENT 'Block e-mailserver blocked ip-ranges for 30 days (runs every 3 hours)'
DO
BEGIN
 -- block the first range of a list of ipranges for 30 days
 update hm_securityranges
  set rangeexpirestime = date_add(now(), interval 30 day)
     ,rangepriorityid = 500
     ,rangename = CONCAT('BLOCK: ', INET_NTOA(rangelowerip1), ' dd: ', now())
  where rangeid > 0
    and rangeid in (
   select distinct rangeid from (
    select rangeid, rangelowerip1, max(rangeexpirestime) as maxexp
   from hm_securityranges r
     where rangename like 'auto-ban%'
    group by rangelowerip1
   ) as ranges
  );
  -- remove all other ranges for the blocked ip addresses from the db
 delete from hm_securityranges where rangename like 'auto-ban%' and rangeexpires = 1;
END |
DELIMITER ;

Note: it may be possible that you block a genuine user of your mail server (who for example forget his password).