Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Looking at the logs on my mailservers, I have noticed messages like the following:

Nov 29 12:09:38 mta postfix/smtpd[8362]: connect from unknown[183.13.165.14]
Nov 29 12:09:39 mta postfix/smtpd[8362]: lost connection after AUTH from unknown[183.13.165.14]
Nov 29 12:09:39 mta postfix/smtpd[8362]: disconnect from unknown[183.13.165.14]
Nov 29 12:09:39 mta postfix/smtpd[8409]: connect from unknown[183.13.165.14]
Nov 29 12:09:40 mta postfix/smtpd[8409]: lost connection after AUTH from unknown[183.13.165.14]
Nov 29 12:09:40 mta postfix/smtpd[8409]: disconnect from unknown[183.13.165.14]

There are no SASL failures in these cases. There are SASL failures are logged at other times, but never with lost connection after AUTH.

What is happening here, and should I do any about it?
These are not MXs, and already have smtpd_client_connection_rate_limit set.

Possibly related:
The systems require either SMTPS or STARTTLS before AUTH is announced.

share|improve this question
    
Can you increase the debug level of postfix? –  Khaled Nov 29 '11 at 21:13
    
I can, but that will grow the log files at a considerably higher rate, and these events are sporadic. What will this increased logging help to disambiguate? –  84104 Nov 29 '11 at 21:17
    
So, you need to increase it for a small period of time and when you expect to get this error. This hopefully gives more hints on what this error means. –  Khaled Nov 29 '11 at 21:22
add comment

2 Answers

up vote 1 down vote accepted

This is a botnet from China connecting to your box trying to deliver Spam. But the bot is too stupid to know what to do when being told to authenticate itself. The bot just stops delivering mail and then disconnects for attacking the next victim.

Absolutely nothing to worry about.

share|improve this answer
    
Close enough. It seems that it's some sort of script that issues AUTH and exits uncleanly after receiving 503 5.5.1 Error: authentication not enabled. Was able to replicate with ncat. Though why it keeps trying until it hits the rate limit is beyond me. Maybe it's trying to brute force username/password pairs? Either way, too stupid too worry about. –  84104 Dec 1 '11 at 0:51
add comment

I'm not sure if there's much to be worried about, basically a client/'someone' is connecting, issuing AUTH and disconnecting on their own accord. It could be an attempt to probe server capabilities from a mail client - or an attempt to case the daemon.

As long as you have sufficient security in place it's just another knock on the door from the world.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.