SMTP connection from (localhost.localdomain)

TCC

• April 03, 2015 07:12

I have continuous connections from different ips with this helo. Blacklisting the ip in cphulk and the smtp blacklist has no effect.
SMTP connection from [xxx.xxx.xxx.xxx]:43659 I=[xxx.xxx.xxx.xxx]:587 (TCP/IP connection count = 1) SMTP protocol error in "AUTH LOGIN" H=(localhost.localdomain) [xxx.xxx.xxx.xxx]:43659 I=[xxx.xxx.xxx.xxx]:587 AUTH command used when not advertised SMTP connection from (localhost.localdomain) [xxx.xxx.xxx.xxx]:43659 I=[xxx.xxx.xxx.xxx]:587 lost no MAIL in SMTP connection from (localhost.localdomain) [xxx.xxx.xxx.xxx]:43659 I=[xxx.xxx.xxx.xxx]:587 D=4s C=EHLO,AUTH,RSET
If I block based on helo, and add localhost.localdomain to the blocklist, will it cause problems, or just drop the connection from all these ips using localhost.localdomain?

• 

  TCC

  • April 03, 2015 17:00

  I've set up the heloblocks as described in this thread

  0
• 

  cPanelMichael

  • April 08, 2015 17:24

  Hello, I am happy to see you were able to find a useable solution. Note that you may want to block those IP addresses in a firewall if the same ones continue to make connection attempts. Thank you.

  0
• 

  TCC

  • April 09, 2015 12:23

  A firewall would be ideal, but unfortunately CSF won't run on this VPS. I've tried all the installation tweaks I can find but have had no luck.

  0
• 

  cPanelMichael

  • April 10, 2015 19:00

  A firewall would be ideal, but unfortunately CSF won't run on this VPS. I've tried all the installation tweaks I can find but have had no luck.

  
  You may want to consult with CSF's support forums (forum.configserver.com) or consider an alternative firewall such as APF. Thank you.

  0

Please sign in to leave a comment.