Re: lots of connections that make no sense

[Allen Coates]

On 15/11/2019 12:33, Wietse Venema wrote:
> Jeffrey 'jf' Lim:
>>> Disabling auth does not stop them from trying;  I scan my logs for the 
>>> string
>>> "auth=0/1", and add the offending IP address to a blacklist - a 
>>> do-it-yourself
>>> fail2ban.
>>>
>>
>> It should. Unless they're the dumbest bots of all time, because you
>> should have stopped advertising auth in your EHLO response after
>> disabling.
> 
> Some bots are stupid. My server does not announce AUTH, but that
> does not stop them from trying.
> 
>       Wietse
> 

Blacklisting miscreants (once you have spotted them) stops them from trying
other probes/attacks.

Allen C