My mail server log. What is happening? reddit / selfhosted ---------------------------------------------------------------------- europacafe · 2023-11-10 17:21 There are a lot of connections from this IP: [185.36.81.40](https://185.36.81.40). Is this IP trying to use my mail server as a relay server? What should I do to get rid of this connection? ​ `Nov 11 00:13:17 mail postfix/submission/smtpd[11720]: warning: hostname srv-185-36-81-40.serveroffer.net does not resolve to address 185.36.81.40: Name or service not known` `Nov 11 00:13:17 mail postfix/submission/smtpd[11720]: connect from unknown[185.36.81.40]` `Nov 11 00:13:21 mail postfix/submission/smtpd[11720]: disconnect from unknown[185.36.81.40] ehlo=1 auth=0/1 rset=0/1 quit=1 commands=2/4` `Nov 11 00:13:31 mail dovecot: imap-login: Login: user=, method=PLAIN, rip=192.168.2.203, lip=192.168.2.202, mpid=13465, TLS, session=` `Nov 11 00:13:31 mail dovecot: imap(chote@bthofen.com): Disconnected: Logged out in=91 out=1006 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0` `Nov 11 00:13:35 mail postfix/anvil[733]: statistics: max connection rate 4/60s for (submission:185.36.81.40) at Nov 11 00:04:15` `Nov 11 00:13:35 mail postfix/anvil[733]: statistics: max connection count 3 for (submission:185.36.81.40) at Nov 11 00:05:21` `Nov 11 00:13:36 mail postfix/submission/smtpd[12149]: warning: hostname srv-185-36-81-40.serveroffer.net does not resolve to address 185.36.81.40: Name or service not known` `Nov 11 00:13:36 mail postfix/submission/smtpd[12149]: connect from unknown[185.36.81.40]` `Nov 11 00:13:38 mail postfix/submission/smtpd[12149]: disconnect from unknown[185.36.81.40] ehlo=1 auth=0/1 rset=0/1 quit=1 commands=2/4` `Nov 11 00:13:51 mail postfix/submission/smtpd[10837]: warning: hostname srv-185-36-81-40.serveroffer.net does not resolve to address 185.36.81.40: Name or service not known` `Nov 11 00:13:51 mail postfix/submission/smtpd[10837]: connect from unknown[185.36.81.40]` `Nov 11 00:13:59 mail postfix/submission/smtpd[10837]: disconnect from unknown[185.36.81.40] ehlo=1 auth=0/1 rset=0/1 quit=1 commands=2/4` ---------------------------------------------------------------------- autogyrophilia · 2023-11-10 17:35 This IP it's failing rDNS, the PTR address of that IP points to the domain name srv-185-36-81-40.serveroffer.net , but not the other way around. This alone does not invalidate a connection but should raise it's spam threshold. It has issued an authentication attempt, and after failing it has quit the connection. If the people at [serveroffer.](https://serveroffer.it)lt do not sound familiar to you, it's probably an automated attack. [https://ipinfo.io/AS209605/185.36.81.0/24](https://ipinfo.io/AS209605 /185.36.81.0/24) The most basic thing you should have in place it's a brute force protector, like fail2ban, or netfilter. Crowsec it's nice too. Otherwise you are going to get hosed. ---------------------------------------------------------------------- europacafe · 2023-11-10 17:51 Thanks. I have crowdsec running on my pfSense. No alert so far and the same log messages on my mail server are still happening. ---------------------------------------------------------------------- autogyrophilia · 2023-11-10 18:13 Crowdsec on your pfsense won't do nothing to parse your postfix logs. ---------------------------------------------------------------------- europacafe · 2023-11-10 18:16 Even adding the IPs to the decision list? ---------------------------------------------------------------------- chronop · 2023-11-10 18:48 The important takeaway is that **their** mail server is misconfigured. Yours seems to be working as intended. You could whitelist their IP in your mail server which should make it skip the rDNS check, but the correct solution is for the sending party to fix their DNS records. ---------------------------------------------------------------------- autogyrophilia · 2023-11-10 21:32 No. Thats a client trying to bruteforce a relay. And whitelisting won't make those errors go away . Just make It so when Mail gets delivered it won't hold it against them. rDNS it's considered outdated, I personally only score them as 2 in rspamd ---------------------------------------------------------------------- autogyrophilia · 2023-11-10 21:37 Crowdsec can't know what that IP it's doing from the pfSense. As crowdsec relies on reading logs. You need to install it on the mail server. Suricata and Snort are also capable of blocking such attacks, but no offense, seem a bit above your pay grade if you are already confused by this. ---------------------------------------------------------------------- europacafe · 2023-11-12 05:43 Well a low pay grade guy is making some progress. I've installed postfix collection on my unraid crowdsec and it made 2 alerts immediately. Unfortunately, not detect the mentioned IP because it is still active in my mail log. ---------------------------------------------------------------------- europacafe · 2023-11-16 06:36 managed to make my crowdsec on Unraid to scan mail.log, and so far has detected, alerted, and stopped 3 IPs.