[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: SMTP problem.

On Tue, 23 Jul 2002, Vineet Kumar wrote:

> * Lars Roland Kristiansen (m00lrk@math.ku.dk) [020723 00:37]:
> > Hi debian security geeks.
> > 
> > I have a woody box running as a mail gateway with postfix (popbeforesmtp
> > and local relay for and pop3 (soon to be imap just need
> > outlook 2002 in the company as it supports multiple imap and pop3
> > accounts). My problem is that my log seem to be running full of strange
> > messages like these.
> > 
> > Jul 23 06:17:53 mail postfix/smtpd[5472]: connect from
> > unknown[]
> > Jul 23 06:17:56 mail postfix/smtpd[5472]: disconnect from
> > unknown[]
> > Jul 23 06:17:58 mail postfix/smtpd[5468]: connect from
> > unknown[]
> > Jul 23 06:17:59 mail postfix/smtpd[5468]: disconnect from
> > unknown[]
> > 
> > 
> > I dont realy see why this is there it seams to come there in about 2-3
> > sec. How do i track this down - i have a firewall in front of it and it is
> > also running iptables - so it should be pretty secure but this should not
> > be there should it ???.
> This doesn't look particularly harmful, but if it is the "unknown" part
> that is scaring you, try adding an entry for in /etc/hosts.
> Other than that, it just looks like that host is making an smtp
> connection and then later disconnecting. This will happen each time it
> relays a message through you, and is nothing to be alarmed about (unless
> you don't intend to be accepting mail from this host, but as I
> understood your setup, that's exactly what you intend to be doing).

Well maby you are right it is only a littel strange that when it ralays a
mail it says somthing like this.

Jul 23 10:10:12 mail
postfix/cleanup[7634]: 1B8CC43C024: message-id=<C093ADA63B306349A0FF08A6619DA67407BE38@travisexch.travis.com>
Jul 23 10:10:12 mail
postfix/qmgr[284]: 1B8CC43C024: from=<lroland@travis.com>, size=794,
nrcpt=1 (queue active)
Jul 23 10:10:12 mail postfix/smtpd[7633]: disconnect from
Jul 23 10:10:13 mail
postfix/smtp[7636]: 1B8CC43C024: to=<m00lrk@math.ku.dk>,
relay=imf.math.ku.dk[], delay=1, status=sent (250 2.0.0
g6N89Qx26308 Message accepted for delivery)

So if this is when it is duing somthing what is the rest and is there a
way to track it down.

Mvh./Yours sincerely


Lars Roland Kristiansen 		         
Stu. Sci. Math/Computer science		           
Copenhagen University -			    
Institute for Mathematical Sciences	       
Url: www.math.ku.dk			   
Email: m00lrk@math.ku.dk		  

   "Politics is for the moment, equations are forever"
                                                    - Albert Einstein

To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Reply to: