• Introducing WebPros Cloud - a fully managed infrastructure platform purpose-built to simplify the deployment of WebPros products !  WebPros Cloud enables you to easily deliver WebPros solutions — without the complexity of managing the infrastructure.
    Join the pilot program today!
  • The Horde component is removed from Plesk Installer. We recommend switching to another webmail software supported in Plesk.
  • The BIND DNS server has already been deprecated and removed from Plesk for Windows.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS. We strongly recommend transitioning to Microsoft DNS within the next 6 weeks, before the Plesk 18.0.70 release.

Malicious authentication attempts on mailserver

Little Giant

New Pleskian
Hey guys,

First post, so apologies if I do not follow any posting standards ;)

Getting the following (A LOT) in our maillog...

Code:
Feb 21 11:45:59 vps146 postfix/smtpd[3475]: connect from 82-160-99-55.tktelekom.pl[82.160.99.55]
Feb 21 11:46:00 vps146 postfix/smtpd[3475]: warning: SASL authentication failure: no secret in database
Feb 21 11:46:00 vps146 postfix/smtpd[3475]: warning: 82-160-99-55.tktelekom.pl[82.160.99.55]: SASL CRAM-MD5 authentication failed: One time use of a plaintext password will enable requested mechanism for user
Feb 21 11:46:01 vps146 plesk_saslauthd[3495]: listen=6, status=5, dbpath='/var/spool/postfix/plesk/passwd.db', keypath='/var/spool/postfix/plesk/passwd_db_key', chroot=0, unprivileged=1
Feb 21 11:46:01 vps146 plesk_saslauthd[3495]: privileges set to (89:89) (effective 89:89)

Just wondering if there should be something added to iptables? I have installed fail2ban on the server and activated the postfix section (I hope!).

Seeing the passwd.db path alerted me somewhat. Any help would be greatly appreciated :)
 
Back
Top