-1

I run on Centos 5 with Parallels Plesk 12 and look for to secure my smtp server. When I watch at log, I see some strange line like that, which I supposed it's hack connexion.

Has someone any idea on how to secure my server from this ?

Oct 10 00:10:45 $myhost$ postfix/smtpd[5736]: warning: XX-XXX-XX-XX-
SFBA.hfc.comcastbusiness.net[XX.XXX.XX.XX]: SASL LOGIN authentication failed:
authentication failureHas someone any idea on how to secure my server from this ? 

(Case 1)

Oct 10 00:10:45 myhost postfix/smtpd[5736]: warning: XX-XXX-XX-XX-
SFBA.hfc.comcastbusiness.net[XX.XXX.XX.XX]: SASL LOGIN authentication failed:
authentication failure

(Case 2)

Oct 10 18:34:11 myhost postfix/qmgr[15890]: 34FEE24FD3: from=<>, size=17347, nrcpt=1 (queue active)
Oct 10 18:34:11 myhost postfix/qmgr[15890]: 79A9224FD2: from=<>, size=17353, nrcpt=1 (queue active)
Oct 10 18:34:11 myhost postfix/smtp[17264]: certificate verification failed for mail.opencamp.fr[92.222.41.176]:25: self-signed certificate
Oct 10 18:34:11 myhost postfix/smtp[17264]: 79A9224FD2: to=<[email protected]>, relay=mail.opencamp.fr[XX.XXX.XX.XX]:25, delay=20963, delays=20963/0.07/0.11/0.04, dsn=4.2.2, status=deferred (host mail.opencamp.fr[XX.XXX.XX.XX] said: 452 4.2.2 Mailbox full (in reply to end of DATA command))
Oct 10 18:34:13 myhost postfix/smtp[17263]: certificate verification failed for mail.opencamp.fr[92.222.41.176]:25: self-signed certificate
Oct 10 18:34:13 myhost postfix/smtp[17263]: 34FEE24FD3: to=<[email protected]>, relay=mail.opencamp.fr[XX.XXX.XX.XX]:25, delay=20964, delays=20962/0.05/2/0.05, dsn=4.2.2, status=deferred (host mail.opencamp.fr[XX.XXX.XX.XX] said: 452 4.2.2 Mailbox full (in reply to end of DATA command))
4
  • Unfortunately, this sort of thing happens all the time with services connected to the Internet. Take heart that the login failed. Oct 9, 2014 at 22:37
  • @KatherineVillyard I hope to. But there is a way to ban this ip ?
    – Alexis G
    Oct 9, 2014 at 22:44
  • 2
    fail2ban.org
    – Sammitch
    Oct 9, 2014 at 22:51
  • I understand for case 1 but I do not understand the message of case 2 ?
    – Alexis G
    Oct 10, 2014 at 16:38

1 Answer 1

-1

I achieved to protect the server from this ip by create iptables rules :

modify /etc/sysconfig/iptables to include rules :
-A INPUT -p tcp --destination-port 25 -j DROP
-I INPUT -s XX.XXX.XX.XX -j DROP

>>> /etc/init.d/iptables save
>>> /etc/init.d/restart save

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .