0

Please note, this is not like the other question asked about the same topic (wrong SSL setup, whatever)! My mail setup works fine, IMAP / POP3 login and smtp is just working.
But I have some log entries I do not understand.

The machine has two interfaces.
eth0 -> 172.16.5.12 (an internal IP)
eth1 -> public IP address

dovecot: auth: Debug: auth client connected (pid=x)  
dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=172.16.5.12, lip=172.16.5.12, TLS, session=<xxxasd>

Postfix uses Dovecot as auth backend (if this is important). I do not perform any other IMAP login from the machine itself.
What I wonder is, why it uses the IP 172.16.5.12 and not even 127.0.0.1 if there would be any attemp.

What I tried:
-A INPUT -i eth0 -p tcp -m tcp --dport 143 -j DROP
-A INPUT -i eth0 -p tcp -m tcp --dport 993 -j DROP

Log entries are still there. If any config snippet is needed to debug what this is, please let me know!

--

I have another mailserver with nearly similar setup, on this server the rip and lip in the maillog is the public IP address from eth1.

Improve this question
2
  • can it be monitoring service which try to connect ? Then it may don't have anything to do with postfix... BTW, to block on loopback, you must use -i lo in your iptables rules, not eth0
    – Dom
    Nov 5, 2019 at 7:18
  • Could be, I will check it. Loopback is on lo, eth0 is not loopback
    – Hannes
    Nov 5, 2019 at 7:25

1 Answer 1

Reset to default
0

The connection was from the monitoring, there was one checking the port if open and one which validated the SSL certificate. Thanks @Dom

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .