0

My server host sent me this message:

80 failed/unauthorized logins attempts via SMTP/IMAP

We have detected abuse from the IP address xx.xxx.xx.xx, which according to a whois lookup is on your network.

Jan 31 07:24:30 server postfix/smtpd[12371]: warning: unknown[xx.xxx.xx.xx]: SASL LOGIN authentication failed: authentication failure

Can someone please let me know where to begin looking at for this?

I already installed Fail2Ban and modified my hosts.allow which was previously sendmail:all and I changed it to sendmail:localhost But both the above methods so far seem ineffective.

I am using Ubuntu 14.04.

Improve this question
4
  • xx.xxx.xx.xx is your IP server address ? or is it an external address banned by your postfix server ?
    – Dom
    Feb 3, 2016 at 12:14
  • @Dom xx.xxx.xx.xx is my IP address. I think somebody is using my server to authenticate to another server.
    – khalid
    Feb 3, 2016 at 12:30
  • Both xx address are the same ? So somebody use your server to test your server ?
    – Dom
    Feb 3, 2016 at 12:37
  • No, it seems more like a hack attempt on a 3rd party server by bombarding too many authentication attempts on that server via my server. It's like my server's smtp is being used somehow by an unknown entity. I changed root password of my server.
    – khalid
    Feb 3, 2016 at 12:40

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .