Strange lines in maillog

J

JackOfAllTrades

I have set up a mail server with sendmail as the MTA and Dovecot as the MDA. I´m not an experienced BSD user but a while ago I bought the book Absolute FreeBSD and I have principally followed Michael W. Lucas when I installed my mail server. Everything is working as I expect and I can receive and send emails but today when I was examining the log files i found the mail log completely crammed with lines like the following:

Code: 
Dec  2 15:40:46 XXX sm-mta[20431]: pB2Eekid020431: [xx.xxx.xxx.xxx] did not issue MAIL/EXPN/VRFY/ETRN during connection to IPv4

What does it mean? I checked up the IP-adress and it´s owned by the company that runs my server.

I have also checked the server config with tools like http://www.mxtoolbox.com and get the following.

Code: 
 OK - 1.2.3.4 resolves to xxx.xxxxxx.se
 OK - Reverse DNS matches SMTP Banner
 0 seconds - Good on Connection time
 Not an open relay.

Everything seems to be ok.

I´m running FreeBSD 8.2-RELEASE-p3, dovecot-1.2.17.

I have also set up some PF rules.

Code: 
scrub in all fragment reassemble
block drop in on le0 all

pass in on le0 inet proto tcp from xx.xxx.xxx.xxx to (server-ip) port = ssh flags S/SA keep state
pass in on le0 inet proto tcp from xx.xxx.xxx.xxx to (server-ip) port = pop3s flags S/SA keep state
pass in on le0 inet proto tcp from any to xxx.xxx.xx.xx port = smtp flags S/SA keep state
pass in on le0 inet proto tcp from any to xxx.xxx.xx.xx port = submission flags S/SA keep state

pass out on le0 proto tcp all flags S/SA keep state
pass out on le0 proto udp all keep state
 
That means that something connected as if it was going to send mail, then didn't do any of the valid commands. Could be manual testing (telnet to port 25), a misguided network monitoring system, a broken spambot, a working spambot aimed at getting around greylisting, or an intrusion attempt.

Contact the ISP and ask them why they're doing it. It might be a surprise to them.
 
You must log in or register to reply here.
Back
Top