Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am noticing the following in my maillog.

Lots of these:

Sep 10 10:29:56 westc01-01-01 postfix/smtpd[26788]: connect from unknown[]

And these:

Sep 10 10:34:58 westc01-01-01 postfix/smtpd[26768]: disconnect from unknown[]
Sep 10 10:34:58 westc01-01-01 postfix/smtpd[26758]: timeout after AUTH from unknown[]

And these:

Sep 10 10:29:56 westc01-01-01 postfix/smtpd[26737]: warning: unknown[]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Are these anything to worry about?

share|improve this question
up vote 3 down vote accepted

Looks like just another random connection attempt from part of a botnet. Assuming your mail server is properly secured, you can ignore it. Of course, this is a good time to check and ensure that your mail server is properly secured.

share|improve this answer

As others have said, this is normal background noise and nothing to worry about as long as your server is properly secured. If you want to do something about it anyway, you could use fail2ban to block attackers/bots after a number of unsuccessful attempts.

share|improve this answer

Need not to worry someone is trying to connect from your server but the sasl username and password he/she using for login is wrong that's why it's creating unsuccessful sasl login attems log. your server is secured from open relaying.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.