-1

Someone or "something" is trying to access the server.

my postfix log showed: 

mx2 postfix/smtpd[*****]: lost connection after MAIL from unknown[127.0.0.1]

My concern is why is it from the localhost? and I just can't figure it out with "after MAIL" means.

schroeder
  • 123,438
  • 55
  • 284
  • 319
zapdos3
  • 13
  • 4

1 Answers1

2

My concern is why is it from the localhost?

That is impossible for us to say. Very possibly you have an automated process on your system that tried to send mail. Alternately, something like an FTP bounce attack could be used to make a local SMTP connection. But there's really no info here for us to help you track it down.

I just can't figure it out with "after MAIL" means.

This, at least, is simple. The SMTP protocol consists of a series of commands: HELO or EHLO, MAIL FROM, RCPT TO, DATA, QUIT. The log entry "after MAIL" means that the connection said HELO and then said MAIL FROM: <user@example.org>. The client then disconnected, so Postfix is telling you, literally, they disconnected after the MAIL command. No mail would have been sent due to the aborted connection.

gowenfawr
  • 71,975
  • 17
  • 161
  • 198