• We value your experience with Plesk during 2025
    Plesk strives to perform even better in 2026. To help us improve further, please answer a few questions about your experience with Plesk Obsidian 2025.
    Please take this short survey:

    https://survey.webpros.com/

Malicious authentication attempts on mailserver

Little Giant

New Pleskian
Hey guys,

First post, so apologies if I do not follow any posting standards ;)

Getting the following (A LOT) in our maillog...

Code:
Feb 21 11:45:59 vps146 postfix/smtpd[3475]: connect from 82-160-99-55.tktelekom.pl[82.160.99.55]
Feb 21 11:46:00 vps146 postfix/smtpd[3475]: warning: SASL authentication failure: no secret in database
Feb 21 11:46:00 vps146 postfix/smtpd[3475]: warning: 82-160-99-55.tktelekom.pl[82.160.99.55]: SASL CRAM-MD5 authentication failed: One time use of a plaintext password will enable requested mechanism for user
Feb 21 11:46:01 vps146 plesk_saslauthd[3495]: listen=6, status=5, dbpath='/var/spool/postfix/plesk/passwd.db', keypath='/var/spool/postfix/plesk/passwd_db_key', chroot=0, unprivileged=1
Feb 21 11:46:01 vps146 plesk_saslauthd[3495]: privileges set to (89:89) (effective 89:89)

Just wondering if there should be something added to iptables? I have installed fail2ban on the server and activated the postfix section (I hope!).

Seeing the passwd.db path alerted me somewhat. Any help would be greatly appreciated :)
 
Back
Top