0

I have a Zimbra Mail Server setup, and have noticed quite a few connection attempts on port 25 which are rejected because the reverse lookup fails. Here is an example output:

Apr 30 06:04:48 mx1 postfix/postscreen[25405]: CONNECT from [213.221.224.122]:58241 to [MyInternalIP]:25
Apr 30 06:04:48 mx1 postfix/postscreen[25405]: PREGREET 11 after 0.06 from [213.221.224.122]:58241: EHLO User\r\n
Apr 30 06:04:48 mx1 postfix/smtpd[4021]: connect from 213-221-224-122.static.ftth.fcom.ch[213.221.224.122]
Apr 30 06:04:48 mx1 postfix/smtpd[4021]: disconnect from 213-221-224-122.static.ftth.fcom.ch[213.221.224.122] ehlo=1 quit=1 commands=2
Apr 30 06:04:55 mx1 postfix/postscreen[25405]: CONNECT from [85.234.126.92]:59355 to [MyInternalIP]:25
Apr 30 06:04:56 mx1 postfix/postscreen[25405]: PREGREET 11 after 0.15 from [85.234.126.92]:59355: EHLO User\r\n
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: warning: hostname empty.stranzit.ru does not resolve to address 85.234.126.92: Name or service not known
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: connect from unknown[85.234.126.92]
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: disconnect from unknown[85.234.126.92] ehlo=1 quit=1 commands=2

I have looked on the Zimbra Forum, and even posted there, bit no-one seems to know if I should be worried. The posts on this forum reassure me that I should not.

Should I go to the trouble of blocking these IPs either on my router or using the iptables on my firewall, or just ignore them. Sometimes these 'Scans' occur every few seconds or minutes.

themetman
  • 1
  • I forgot to add that checking the WhoIs on most of the addresses I am collecting they are already flagged as 'Abusive' – themetman May 09 '19 at 07:15
  • I consider it the background noise of the internet and when no other actions like brute force login attempts are done (those offending IP-addresses I do block with fail2ban ) I wouldn't worry too much. – HBruijn May 09 '19 at 07:17
  • 1
    Rather than using comments to add detail you forgot, please use the [`edit`](https://serverfault.com/posts/966511/edit) link below your question. – HBruijn May 09 '19 at 07:18
  • Many thanks for the reassurance, and also for the edit advice. Regards – themetman May 09 '19 at 12:43

0 Answers0