0

I have a VPS configured to use PHP to send out periodical alerts via email (sendmail) where I connect via SMTP to a google apps email account. The server is using EXIM as the transfer agent.

In the EXIM logs, exim_mainlog, I am seeing SMTP connections from IP addresses that seem to be successfully connecting and sending spam messages.

2018-04-03 12:48:53 SMTP connection from [202.77.50.129]:27892 (TCP/IP connection count = 1)
2018-04-03 12:48:54 SMTP connection from 202077050129.static.ctinets.com () [202.77.50.129]:27892 closed by QUIT

I am at a loss on how or where to start to prevent these unauthorized SMTP connections?

3
  • Disable inbound SMTP.
    – joeqwerty
    Apr 3, 2018 at 18:37
  • Forgive my lack of knowledge in this area. Will this prevent us receiving email to our google apps (gsuite) inboxes which for our domain? e.g. our MX records for the domain are for googles servers.
    – skribe
    Apr 3, 2018 at 18:42
  • If this server sends email outbound but does not receive email inbound then you do not need to allow inbound SMTP traffic to the server.
    – joeqwerty
    Apr 3, 2018 at 19:04

1 Answer 1

0

This is normal for any server accessible on the internet. There is, and always will be, random user/scripts/bots trying to connect to anything they can get their hands on to try and abuse.

You should make sure that you take the proper precautions to prevent abuse of your SMTP server. Things like a proper HELO, IP white-listing, not being an open relay, authenticated logins only, etc. You can use a firewall to help block unwanted connections, but there's always going to be more IP's that are trying even after you block them.

You might want to start with the EXIM docs on how to harden EXIM: https://www.exim.org/exim-html-current/doc/html/spec_html/ch-security_considerations.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .