postfix- are these connects in the log anything to worry about?

Question

I am noticing the following in my maillog.

Lots of these:

Sep 10 10:29:56 westc01-01-01 postfix/smtpd[26788]: connect from unknown[85.111.7.182]

And these:

Sep 10 10:34:58 westc01-01-01 postfix/smtpd[26768]: disconnect from unknown[85.111.7.182]
Sep 10 10:34:58 westc01-01-01 postfix/smtpd[26758]: timeout after AUTH from unknown[85.111.7.182]

And these:

Sep 10 10:29:56 westc01-01-01 postfix/smtpd[26737]: warning: unknown[85.111.7.182]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Are these anything to worry about?

Answer 1

Looks like just another random connection attempt from part of a botnet. Assuming your mail server is properly secured, you can ignore it. Of course, this is a good time to check and ensure that your mail server is properly secured.

Answer 2

As others have said, this is normal background noise and nothing to worry about as long as your server is properly secured. If you want to do something about it anyway, you could use fail2ban to block attackers/bots after a number of unsuccessful attempts.

Answer 3

Need not to worry someone is trying to connect from your server but the sasl username and password he/she using for login is wrong that's why it's creating unsuccessful sasl login attems log. your server is secured from open relaying.