Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

During a random check of my postfix logs (which always leave me worried when I see all those attempts to use my server as a relay) I noticed lines like these:

Jul 01 01:26:37 *** postfix/smtpd[15289]: connect from unknown[XX.XX.XX.XX]
Jul 01 01:26:37 *** postfix/smtpd[15289]: lost connection after UNKNOWN from unknown[XX.XX.XX.XX]

Each second, three of these requests were made, in total 72 last night. Since November last year, a total of 1198 of such requests exist in the server logs. Although not particularly many, what worries me is that I can't find anything related via google. Apparently, somebody tries a command that postfix doesn't know.

Is this kind of attack known? Can I do anything against it? Thank you!

share|improve this question
up vote 2 down vote accepted

Most likely they are scanning for something that your server won't do. This is actually the best thing you could be seeing.

People get scanning and bruteforce all day, every day, directed at random IPs (sometimes even within specific ranges known to be used for servers). It's not usually anything to worry about. However, should you choose to worry anyway, the best way to prevent those types of connections from reaching you at all are IPS systems (like fail2ban).

share|improve this answer
Thank you. I will read into such methods, but you made me worry a little less. :) – janoliver Jul 1 '13 at 8:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.