My mail server log. What is happening?
My mail server log. What is happening?
There are a lot of connections from this IP: 185.36.81.40. Is this IP trying to use my mail server as a relay server? What should I do to get rid of this connection?
Nov 11 00:13:17 mail postfix/submission/smtpd[11720]: warning: hostname srv-185-36-81-40.serveroffer.net does not resolve to address 185.36.81.40: Name or service not known
Nov 11 00:13:17 mail postfix/submission/smtpd[11720]: connect from unknown[185.36.81.40]
Nov 11 00:13:21 mail postfix/submission/smtpd[11720]: disconnect from unknown[185.36.81.40] ehlo=1 auth=0/1 rset=0/1 quit=1 commands=2/4
Nov 11 00:13:31 mail dovecot: imap-login: Login: user=, method=PLAIN, rip=192.168.2.203, lip=192.168.2.202, mpid=13465, TLS, session=
Nov 11 00:13:31 mail dovecot: imap(chote@xxxxx.com)<13465>: Disconnected: Logged out in=91 out=1006 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov 11 00:13:35 mail postfix/anvil[733]: statistics: max connection rate 4/60s for (submission:185.36.81.40) at Nov 11 00:04:15
Nov 11 00:13:35 mail postfix/anvil[733]: statistics: max connection count 3 for (submission:185.36.81.40) at Nov 11 00:05:21
Nov 11 00:13:36 mail postfix/submission/smtpd[12149]: warning: hostname srv-185-36-81-40.serveroffer.net does not resolve to address 185.36.81.40: Name or service not known
Nov 11 00:13:36 mail postfix/submission/smtpd[12149]: connect from unknown[185.36.81.40]
Nov 11 00:13:38 mail postfix/submission/smtpd[12149]: disconnect from unknown[185.36.81.40] ehlo=1 auth=0/1 rset=0/1 quit=1 commands=2/4
Nov 11 00:13:51 mail postfix/submission/smtpd[10837]: warning: hostname srv-185-36-81-40.serveroffer.net does not resolve to address 185.36.81.40: Name or service not known
Nov 11 00:13:51 mail postfix/submission/smtpd[10837]: connect from unknown[185.36.81.40]
Nov 11 00:13:59 mail postfix/submission/smtpd[10837]: disconnect from unknown[185.36.81.40] ehlo=1 auth=0/1 rset=0/1 quit=1 commands=2/4
This IP it's failing rDNS, the PTR address of that IP points to the domain name srv-185-36-81-40.serveroffer.net , but not the other way around. This alone does not invalidate a connection but should raise it's spam threshold.
It has issued an authentication attempt, and after failing it has quit the connection.
If the people at serveroffer.lt do not sound familiar to you, it's probably an automated attack.
https://ipinfo.io/AS209605/185.36.81.0/24
The most basic thing you should have in place it's a brute force protector, like fail2ban, or netfilter. Crowsec it's nice too. Otherwise you are going to get hosed.
2