Question Intruder connected to my vm by smtp

[Javi]

hi

Today I had to throw an intruder in my vm that was connected by smtp, how do I have to do so that it does not happen again

Thanks

 

[Bitpalast]

It is common that attackers try to login to mailboxes to send spam through them, so you normally see many connects and login attempts from a variety of ip addresses. The default solution for this is to activate the Fail2Ban Postfix and Dovecot jails. They will catch failed login attempts and block attacker IPs.

However, if you found a successful login attempt by a foreign IP, you need to change the password of that mailbox.

 

[Javi]

thank you Peter for the answer.
with the netstat -putona command I saw the connection established with the smtp program

 

[Bitpalast]

What is the problem with that?

 

[Javi]

I do not believe that the intruder entered my mailbox, however with the netstate command I see that there is a connection established by the intruder with the smtp port and I do not know what consequences this connection may have

 

[Bitpalast]

None.