this post was submitted on 10 Nov 2023
3 points (100.0% liked)

Self-Hosted Main

515 readers
1 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

For Example

We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.

Useful Lists

founded 1 year ago
MODERATORS
communick@selfhosted.forum
3
My mail server log. What is happening? (alien.top)
submitted 1 year ago by europacafe@alien.top to c/main@selfhosted.forum
1 comments fedilink hide all child comments
 

There are a lot of connections from this IP: 185.36.81.40. Is this IP trying to use my mail server as a relay server? What should I do to get rid of this connection?

โ€‹

Nov 11 00:13:17 mail postfix/submission/smtpd[11720]: warning: hostname srv-185-36-81-40.serveroffer.net does not resolve to address 185.36.81.40: Name or service not known

Nov 11 00:13:17 mail postfix/submission/smtpd[11720]: connect from unknown[185.36.81.40]

Nov 11 00:13:21 mail postfix/submission/smtpd[11720]: disconnect from unknown[185.36.81.40] ehlo=1 auth=0/1 rset=0/1 quit=1 commands=2/4

Nov 11 00:13:31 mail dovecot: imap-login: Login: user=, method=PLAIN, rip=192.168.2.203, lip=192.168.2.202, mpid=13465, TLS, session=

Nov 11 00:13:31 mail dovecot: imap(chote@xxxxx.com)<13465>: Disconnected: Logged out in=91 out=1006 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0

Nov 11 00:13:35 mail postfix/anvil[733]: statistics: max connection rate 4/60s for (submission:185.36.81.40) at Nov 11 00:04:15

Nov 11 00:13:35 mail postfix/anvil[733]: statistics: max connection count 3 for (submission:185.36.81.40) at Nov 11 00:05:21

Nov 11 00:13:36 mail postfix/submission/smtpd[12149]: warning: hostname srv-185-36-81-40.serveroffer.net does not resolve to address 185.36.81.40: Name or service not known

Nov 11 00:13:36 mail postfix/submission/smtpd[12149]: connect from unknown[185.36.81.40]

Nov 11 00:13:38 mail postfix/submission/smtpd[12149]: disconnect from unknown[185.36.81.40] ehlo=1 auth=0/1 rset=0/1 quit=1 commands=2/4

Nov 11 00:13:51 mail postfix/submission/smtpd[10837]: warning: hostname srv-185-36-81-40.serveroffer.net does not resolve to address 185.36.81.40: Name or service not known

Nov 11 00:13:51 mail postfix/submission/smtpd[10837]: connect from unknown[185.36.81.40]

Nov 11 00:13:59 mail postfix/submission/smtpd[10837]: disconnect from unknown[185.36.81.40] ehlo=1 auth=0/1 rset=0/1 quit=1 commands=2/4

top 1 comments
sorted by: hot top controversial new old
[โ€“] autogyrophilia@alien.top 2 points 1 year ago

This IP it's failing rDNS, the PTR address of that IP points to the domain name srv-185-36-81-40.serveroffer.net , but not the other way around. This alone does not invalidate a connection but should raise it's spam threshold.

It has issued an authentication attempt, and after failing it has quit the connection.

If the people at serveroffer.lt do not sound familiar to you, it's probably an automated attack.

https://ipinfo.io/AS209605/185.36.81.0/24

The most basic thing you should have in place it's a brute force protector, like fail2ban, or netfilter. Crowsec it's nice too. Otherwise you are going to get hosed.