Topic: lost connection after CONNECT from unknown
==== Required information ====
- iRedMail version (check /etc/iredmail-release):
- Linux/BSD distribution name and version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Web server (Apache or Nginx):
- Manage mail accounts with iRedAdmin-Pro?
- Related log if you're reporting an issue:
======== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.4
- Linux/BSD distribution name and version: Raspbian 8.0 on RaspberryPi2
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySql
- Web server (Apache or Nginx): Apache
- Manage mail accounts with iRedAdmin-Pro? NO
- Related log if you're reporting an issue:
====
Hi my log file is getting filled up by Attack and the IP is not added to Iptables by fail2ban
Here is a small print from the log file
Apr 13 20:20:17 mail postfix/postscreen[8354]: CONNECT from [155.133.82.65]:50734 to [91.88.1.20]:25
Apr 13 20:20:17 mail postfix/postscreen[8354]: PASS OLD [155.133.82.65]:50734
Apr 13 20:20:27 mail postfix/smtpd[8355]: connect from unknown[155.133.82.65]
Apr 13 20:20:27 mail postfix/smtpd[8355]: lost connection after CONNECT from unknown[155.133.82.65]
Apr 13 20:20:27 mail postfix/smtpd[8355]: disconnect from unknown[155.133.82.65]
Apr 13 20:23:14 mail postfix/postscreen[8403]: CONNECT from [155.133.82.65]:59941 to [91.88.1.20]:25
Apr 13 20:23:14 mail postfix/postscreen[8403]: PASS OLD [155.133.82.65]:59941
Apr 13 20:23:24 mail postfix/smtpd[8404]: connect from unknown[155.133.82.65]
Apr 13 20:23:24 mail postfix/smtpd[8404]: lost connection after CONNECT from unknown[155.133.82.65]
Apr 13 20:23:24 mail postfix/smtpd[8404]: disconnect from unknown[155.133.82.65]
Apr 13 20:26:12 mail postfix/postscreen[8418]: CONNECT from [155.133.82.65]:63095 to [91.88.1.20]:25
Apr 13 20:26:12 mail postfix/postscreen[8418]: PASS OLD [155.133.82.65]:63095
Apr 13 20:26:22 mail postfix/smtpd[8419]: connect from unknown[155.133.82.65]
Apr 13 20:26:22 mail postfix/smtpd[8419]: lost connection after CONNECT from unknown[155.133.82.65]
Apr 13 20:26:22 mail postfix/smtpd[8419]: disconnect from unknown[155.133.82.65]
Apr 13 20:29:13 mail postfix/postscreen[8422]: CONNECT from [155.133.82.65]:59236 to [91.88.1.20]:25
Apr 13 20:29:13 mail postfix/postscreen[8422]: PASS OLD [155.133.82.65]:59236
Apr 13 20:29:24 mail postfix/smtpd[8423]: connect from unknown[155.133.82.65]
Apr 13 20:29:24 mail postfix/smtpd[8423]: lost connection after CONNECT from unknown[155.133.82.65]
Apr 13 20:29:24 mail postfix/smtpd[8423]: disconnect from unknown[155.133.82.65]
failt2ban is working
ps -ef | grep fail2ban
root 1143 1 0 20:30 ? 00:00:04 /usr/bin/python /usr/bin/fail2ban-server -b -s /var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail2ban.pid
pi 1667 1269 0 20:40 pts/0 00:00:00 grep --color=auto fail2ban
How can i fight this attacks?
Creers Ziga
----
Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.