# 535 Incorrect authentication data **URL:** \ **Category:** Uncategorized\ **Created:** [January 24, 2020, 4:54pm UTC](https://forum.hestiacp.com/t/535-incorrect-authentication-data/399 "2020-01-24T16:54:20Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![xcosmicx](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/x/d2c977/32.png) [@xcosmicx](https://forum.hestiacp.com/u/xcosmicx)\ **Post date:** [January 24, 2020, 4:54pm UTC](https://forum.hestiacp.com/t/535-incorrect-authentication-data/399/1 "2020-01-24T16:54:20Z")
I’m on Ubuntu 18.04 running HestiaCP Version 1.0.6. I’ve migrated a domain from a VestaCP running 16.04 Ubuntu, my question is… Why so many: `dovecot_login authenticator failed for (User) ip-address-here: 535 Incorrect authentication data` error on my exim4 main log. Why fail2ban is not banning those IP addresses. Based on the log, I think a bot is bruteforcing email login on my server, targeting the domain I just migrated. Is there anyway to fix this? No banned IP in Fail2ban/Fireall section of HestiaCP. NOTE: The migrated domain running on the HestiaCP machine is not yet live. The domain still points to the VestaCP server, so just wondering how the have discovered the new server and started brute forcing it. ---
**Author:** ![Raphael](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/raphael/32/5217_2.png) [@Raphael](https://forum.hestiacp.com/u/Raphael)\ **Post date:** [January 24, 2020, 6:54pm UTC](https://forum.hestiacp.com/t/535-incorrect-authentication-data/399/2 "2020-01-24T18:54:53Z")
Just on mobile, but could this be related? [https://forum.vestacp.com/viewtopic.php?t=9040#p30273](https://forum.vestacp.com/viewtopic.php?t=9040#p30273) Can you maybe check it on your side and have a look, if adjust the filters will ban the attacker? If you like, you can also create a pull request with adjusted fail2ban filters. ---
**Author:** ![xcosmicx](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/x/d2c977/32.png) [@xcosmicx](https://forum.hestiacp.com/u/xcosmicx)\ **Post date:** [January 27, 2020, 8:43am UTC](https://forum.hestiacp.com/t/535-incorrect-authentication-data/399/3 "2020-01-27T08:43:12Z")
Hi there! Thank you for responding. I did actually read on that topic, but was hesitant to apply the suggested solution, since I thought HestiaCP had fixed that on their fork. What seemed to worked for me though, was inserting findtime and maxretry, on the exim and dovecot configs. When I check on `/var/log/fail2ban.log` there were banned IPs for exim. What are your thought on this? Is it problem sovled and should I move on now? Sorry I asked, I’m not an expert on this, just learning by myself. ---
**Author:** ![Raphael](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/raphael/32/5217_2.png) [@Raphael](https://forum.hestiacp.com/u/Raphael)\ **Post date:** [January 27, 2020, 9:52am UTC](https://forum.hestiacp.com/t/535-incorrect-authentication-data/399/4 "2020-01-27T09:52:34Z")
Just checked: The filter files arent shipped with hestia itself, it uses the system default. So I don’t know if the issue is resolved, depends if you still have no entry for dovecot attack bans? ---
**Author:** ![xcosmicx](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/x/d2c977/32.png) [@xcosmicx](https://forum.hestiacp.com/u/xcosmicx)\ **Post date:** [January 27, 2020, 11:00am UTC](https://forum.hestiacp.com/t/535-incorrect-authentication-data/399/5 "2020-01-27T11:00:12Z")
HI! Yeah, have these entries for exim and dovecot. Please see image reference link below. Image: ![](https://forum.hestiacp.com/uploads/default/original/1X/2f2f3addd59cb5f878beb743f9307be809e0dd25.png) Thanks for responding. ---
**Author:** ![Raphael](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/raphael/32/5217_2.png) [@Raphael](https://forum.hestiacp.com/u/Raphael)\ **Post date:** [January 27, 2020, 2:48pm UTC](https://forum.hestiacp.com/t/535-incorrect-authentication-data/399/6 "2020-01-27T14:48:16Z")
Hmm, can you also post a iptables -L to show the banned ips? Please think about to anonmyze non attacker ip addresses. ---
**Author:** ![xcosmicx](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/x/d2c977/32.png) [@xcosmicx](https://forum.hestiacp.com/u/xcosmicx)\ **Post date:** [January 27, 2020, 4:32pm UTC](https://forum.hestiacp.com/t/535-incorrect-authentication-data/399/7 "2020-01-27T16:32:45Z")
I’m sorry, I’m not sure how should I anonymize non attacker IP addresses. There are lots of them and seems like all attackers. iptables -L output: [https://pastebin.com/MyawvXzs](https://pastebin.com/MyawvXzs) ---
**Author:** ![Raphael](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/raphael/32/5217_2.png) [@Raphael](https://forum.hestiacp.com/u/Raphael)\ **Post date:** [January 27, 2020, 5:11pm UTC](https://forum.hestiacp.com/t/535-incorrect-authentication-data/399/8 "2020-01-27T17:11:03Z")
Looks all is working properly, the attacker got banned in iptables: `1. REJECT all -- 46.38.144.49 anywhere reject-with icmp-port-unreachable`