View realtime list of connections to Postfix [closed]

Question

I am running Postfix on a linux box with a couple hundred local users with mailboxes.

Is there a way to monitor all incoming connections (SMTP) to the Postfix service? I.e. a live stream of "IP Address x.x.x.x just connected to the Postfix server" and "IP Address y.y.y.y just disconnected" ?

I want to monitor all incoming connections so I can look for trends of the same IP address attempting to send multiple spam to my users or possibly trying to relay (it's not an open relay btw!).

Just dumping all connections and disconnections, with IP address listed, to a text file or syslog would be perfect. Or possibly there is another, better way?

Thanks!

Answer 1

postfix logs each connection as it comes in, and the log lines look like

Jul  8 16:25:15 swiss postfix/smtpd[11127]: connect from some.host.or.other [192.0.2.1]

so you can tail -F your logfile (on my system it's /var/log/mail.log), use grep to filter the lines you want, and watch the live traffic.

Answer 2

The above poster is close.

tail allows you to see the last 10 lines in a file. The -f switch allows you to see new lines as they are appended to the maillog file.

cd /var/log

tail -f maillog

Ctrl+c to escape.

Seeing this is already written to a file called /var/log/maillog, not sure why you would want to create another file unless you are looking to extract specific information.

If you want to just read the maillog, use your favorite editor or do this:

less maillog

hitting the Enter (return) key will move the file down a single line at a time or you can hit the Page Down key for a full screen move.

HHitting the q key will escape you out.

Answer 3

I found the following helpful:

tail -f maillog | grep connect

But you could grep for disconnect or a specific IP if you wanted?

Answer 4

This will give you a count of all the IPs in your mail.log file so you can identify nuisance IPs.

grep connect /var/log/mail.log |grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" | sort | uniq -c | sort

Use ipset to create blacklists and add them in your ip tables

Create blacklists:

ipset create <nameof blacklist> hash:ip (or net) -hashsize 4096

ipset add <nameof blacklist> <IP or network/nn>

Match blacklists and drop:

iptables -I INPUT -m set --match-set <nameof blacklist> src -j DROP
iptables -I FORWARD -m set --match-set <nameof blacklist> src -j DROP

You could probably script and automate this.