mailserver crash after "Error: Error reading data."

[gyrosc...@gmail.com]

The mailserver is crashing quite a bit at the moment.

example from logs

[SSM2 000029 29-06-23 12:58:35] Incrementing the counter for IP address 122.187.229.7 in lockout manager: Current=1, Allowed=20.
[SSM2 000029 29-06-23 12:58:35] 535 Authentication failed
[SSM2 000029 29-06-23 12:58:36] Error: Error reading data.
[SSM2 000029 29-06-23 12:58:36] Secondary SMTP connection 000029 on <I removed IP Address> (465) with 122.187.229.7 (59755) ended
[SSM2 000029 29-06-23 12:58:36] Number of current secondary SMTP connections: 0
[SYST XXXXXX 29-06-23 13:00:23] Server stop has been registered

Note: We are experience hacking attacks at the moment where people are trying to crack

passwords. I'm using IP blocking but they are using quite a few IP addresses and whatever they are doing is making the mailserver unstable. 

Anyone else had this problem?

[gyrosc...@gmail.com]

This has been going on for over a week. Crash always occurs after the lockout manager increments.

Hence it is happening once or twice a day. 

My gut feeling is there is  bug in the lockout script or database call.

I checked the passwords attempted, by the attacker and they are simple and short. So no overflows or unhandled characters.

[Ken Poulsen]

I Can see you allow 20 tries… i lock-out much sooner… mine is set to 3 or 4 in one minute… (and yes has had a few trying to bypass, so have tried to have more than 5000 on the autolockout.. (my lockout time is 3 weeks)

[tim cornatzer]

I agree. My lockout is set to 3, with a 6000 minute lockout time. Sometimes I have to block IPs at the firewall for pesky hackers. I usually block out IPs with Class A or /8 subnet mask. Using Geobytes I can determine and make sure the IP block is from overseas, and sometimes create large blocks of IPs to not allow access to the server.

--
You received this message because you are subscribed to the Google Groups "ArGoSoft Products" group.
To unsubscribe from this group and stop receiving emails from it, send an email to argosoft-produ...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/argosoft-products/7ea312cd-2a4c-4bbb-80d0-44e25e998813n%40googlegroups.com.

[gyrosc...@gmail.com]

I've tried 3 to 30. All producing the same results. It crashes the server after a while. I'm trying to figure out the cause of the "error: Error reading Data".

3 is my preferred and was using that for most of this week.

Today I turned the lockout off completely. No impact still caused the server to crash twice so far.

[gyrosc...@gmail.com]

Right quick and dirty fix.

lockout set back on to 3

Task scheduler set to start/restart argo every 10 minutes.  That should do the trick until the cause is found.

[ArGoSoft Products]

Sorry for the delay.

I am not exactly sure what could be causing that, but can you try Tools - Utilities - Maintenance - Shrink database and see if it fixes the problem?

Thanks

Archie

[Matthew Corrow]

Can I ask a couple of questions:

1 is the lockout table getting new entries, or are you having a database problem.

2 is it possible that the error reading data is that they have terminated the connection, as it seems to be related to that particular connection?

3 any disk issues with the database? Are you nearing max size?

--
Sent from Open Mail on Android.

[gyrosc...@gmail.com]

Would it be possible to give more detailed errors on the next mailserver update? Maybe what function or database call is rather than just "Error: Error reading data."

[gyrosc...@gmail.com]

1)yes. no database issues

2) it could be but I don't know for sure.

3) No disk or database issues. plenty of space other databases running fine.

[gyrosc...@gmail.com]

This is still ongoing.

Roughly half our SMTP connections have failed authentication. During heavy attacks the server crashes repeated throughout the day.

About half a dozen times but it really depends on the scale of the attack.