Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

During a random check of my postfix logs (which always leave me worried when I see all those attempts to use my server as a relay) I noticed lines like these:

Jul 01 01:26:37 *** postfix/smtpd[15289]: connect from unknown[XX.XX.XX.XX]
Jul 01 01:26:37 *** postfix/smtpd[15289]: lost connection after UNKNOWN from unknown[XX.XX.XX.XX]

Each second, three of these requests were made, in total 72 last night. Since November last year, a total of 1198 of such requests exist in the server logs. Although not particularly many, what worries me is that I can't find anything related via google. Apparently, somebody tries a command that postfix doesn't know.

Is this kind of attack known? Can I do anything against it? Thank you!

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Most likely they are scanning for something that your server won't do. This is actually the best thing you could be seeing.

People get scanning and bruteforce all day, every day, directed at random IPs (sometimes even within specific ranges known to be used for servers). It's not usually anything to worry about. However, should you choose to worry anyway, the best way to prevent those types of connections from reaching you at all are IPS systems (like fail2ban).

share|improve this answer
    
Thank you. I will read into such methods, but you made me worry a little less. :) –  janoliver Jul 1 '13 at 8:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.