1

Topic: mail.log flooded with lost connection after EHLO from unknown

==== Required information ====
- iRedMail version (check /etc/iredmail-release):
- Linux/BSD distribution name and version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Web server (Apache or Nginx):
- Manage mail accounts with iRedAdmin-Pro?
- Related log if you're reporting an issue:
============ Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.2
- Linux/BSD distribution name and version: Debian 8.0
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Apache
- Manage mail accounts with iRedAdmin-Pro? No
- Related log if you're reporting an issue: Yes
====

My server's mail.log is flooded with such messages.
There are too much messages

Dec 30 12:51:23 mail postfix/smtpd[15504]: lost connection after EHLO from unknown[172.25.12.79]
Dec 30 12:51:23 mail postfix/smtpd[15504]: disconnect from unknown[172.25.12.79]
Dec 30 12:51:23 mail postfix/smtpd[15504]: connect from unknown[172.25.12.79]
Dec 30 12:51:23 mail postfix/smtpd[15504]: lost connection after EHLO from unknown[172.25.12.79]
Dec 30 12:51:23 mail postfix/smtpd[15504]: disconnect from unknown[172.25.12.79]

What could be the cause for it and how to fix it?
Please help.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 (edited by rafaelr 2015-12-30 16:31:49)

Re: mail.log flooded with lost connection after EHLO from unknown

That's a reserved internal IP block. Wherever you're hosting they most likely have a 172.16.0.0/12 internal network. If this is not your own LAN IP, I suggest for you to block it.

$ iptables -I INPUT -s 172.25.12.79 -j DROP

You may want to contact your provider to let them know about the issue and get further assistance.