Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am noticing the following in my maillog.

Lots of these:

Sep 10 10:29:56 westc01-01-01 postfix/smtpd[26788]: connect from unknown[85.111.7.182]

And these:

Sep 10 10:34:58 westc01-01-01 postfix/smtpd[26768]: disconnect from unknown[85.111.7.182]
Sep 10 10:34:58 westc01-01-01 postfix/smtpd[26758]: timeout after AUTH from unknown[85.111.7.182]

And these:

Sep 10 10:29:56 westc01-01-01 postfix/smtpd[26737]: warning: unknown[85.111.7.182]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Are these anything to worry about?

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

Looks like just another random connection attempt from part of a botnet. Assuming your mail server is properly secured, you can ignore it. Of course, this is a good time to check and ensure that your mail server is properly secured.

share|improve this answer
add comment

As others have said, this is normal background noise and nothing to worry about as long as your server is properly secured. If you want to do something about it anyway, you could use fail2ban to block attackers/bots after a number of unsuccessful attempts.

share|improve this answer
add comment

Need not to worry someone is trying to connect from your server but the sasl username and password he/she using for login is wrong that's why it's creating unsuccessful sasl login attems log. your server is secured from open relaying.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.