Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For over 24 hours now, my CentOS6 server has been bombarded with the following connections. There are thousands of these log entries. I have set up Fail2ban and this has now banned over 10000 IPs and this has only slowed it down slightly :-(

My question is, what is this trying to achieve? And how can I stop it?

I'm fairly certain my server is still secure but would like to know what is happening.

Thanks in advance for any help.

Sep 14 11:37:19 myservername  postfix/smtpd[14623]: lost connection after UNKNOWN from unknown[182.189.132.235]
    Sep 14 11:37:19 myservername  postfix/smtpd[14623]: disconnect from unknown[182.189.132.235]
    Sep 14 11:37:21 myservername  postfix/smtpd[6810]: lost connection after UNKNOWN from unknown[46.224.255.79]
    Sep 14 11:37:21 myservername  postfix/smtpd[6810]: disconnect from unknown[46.224.255.79]
    Sep 14 11:37:22 myservername  postfix/smtpd[7709]: connect from unknown[46.224.255.79]
    Sep 14 11:37:26 myservername  postfix/smtpd[19646]: connect from unknown[188.245.175.140]
    Sep 14 11:37:29 myservername  postfix/smtpd[19634]: connect from unknown[2.185.92.51]
    Sep 14 11:37:29 myservername  postfix/smtpd[7709]: lost connection after UNKNOWN from unknown[46.224.255.79]
    Sep 14 11:37:29 myservername  postfix/smtpd[7709]: disconnect from unknown[46.224.255.79]
    Sep 14 11:37:32 myservername  postfix/smtpd[19646]: lost connection after UNKNOWN from unknown[188.245.175.140]
    Sep 14 11:37:32 myservername  postfix/smtpd[19646]: disconnect from unknown[188.245.175.140]
    Sep 14 11:37:33 myservername  postfix/smtpd[63325]: connect from unknown[117.195.86.187]
    Sep 14 11:37:35 myservername  postfix/smtpd[14623]: connect from ppp-115-87-13-125.revip4.asianet.co.th[115.87.13.125]
    Sep 14 11:37:35 myservername  postfix/smtpd[19634]: lost connection after UNKNOWN from unknown[2.185.92.51]
    Sep 14 11:37:35 myservername  postfix/smtpd[19634]: disconnect from unknown[2.185.92.51]
    Sep 14 11:37:39 myservername  postfix/smtpd[63325]: lost connection after UNKNOWN from unknown[117.195.86.187]
    Sep 14 11:37:39 myservername  postfix/smtpd[63325]: disconnect from unknown[117.195.86.187]
    Sep 14 11:37:40 myservername  postfix/smtpd[14623]: lost connection after CONNECT from ppp-115-87-13-125.revip4.asianet.co.th[115.87.13.125]
    Sep 14 11:37:40 myservername  postfix/smtpd[14623]: disconnect from ppp-115-87-13-125.revip4.asianet.co.th[115.87.13.125]
    Sep 14 11:37:46 myservername  postfix/smtpd[6810]: connect from unknown[37.255.61.201]
share|improve this question
    
My guess: a botnet try your server. As far as I have checked the addresses this are all dialup hosts. –  deagh Sep 14 '13 at 12:21
    
Not sure if it is a botnet or if the IPs are being spoofed? If it is a botnet then it is pretty massive (10000+ IPs banned and still going strong) and I can't see why my little server would attract that kind of attention. –  ScottG Sep 14 '13 at 13:31
    
I haven't tried it yet, but once I read that it's possible to add geoip to postfix or iptables and block a whole country if most of the attacks are from one country (.th?). –  Jure1873 Sep 14 '13 at 15:48
    
Unfortunately the IPs are from many different countries although, from the sample I have checked, it seems mainly Asia, Russia and Central & South America. –  ScottG Sep 14 '13 at 16:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.