I just stood up a new server running C8 stream, postfix, SA, etc.
I keep seeing these log entries in maillog and wonder what to about them. I have not been able to find any research documents detailing if
this is a problem nor how to prevent. Any documentation I have seen via web searches talks about configuration issues with
spamass-milter. This to me looks like hackers. I get the same four lines over and over again from different IP addresses and the
pid/socket/id number (26579 in this instance) are always linked. The number is different for each query/probe.
Nov 21 11:56:57 dream postfix/smtpd[26579]: connect from unknown[141.98.10.140]
Nov 21 11:56:57 dream postfix/smtpd[26579]: warning: connect to Milter service unix:/run/spamass-milter/spamass-milter.sock: Permission
denied
Nov 21 11:56:57 dream postfix/smtpd[26579]: discarding EHLO keywords: CHUNKING
Nov 21 11:56:57 dream postfix/smtpd[26579]: disconnect from unknown[141.98.10.140] ehlo=1 auth=0/1 quit=1 commands=2/3
What can I try to do to eliminate this? Other than taking up resources I'm not seeing anything else in the logs to show a problem.
Should I be concerned?
Research has now shown that Redhat/Centos may have changed the default postfix setting. I do see the following parameter set:
smtpd_discard_ehlo_keywords = chunking
Sounds like I need to add/set this as 'silent-discard' pseudo keyword to prevent this action from being logged.
Thanks in advance on your help and advice!
Jay
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos
