Hi,

I saw that I had many such attacks...

 

Out: 220 MyServer ESMTP

In:  EHLO Oi9oRGhc

Out: 250-MyServer

Out: 250-PIPELINING

Out: 250-SIZE 5000000

Out: 250-ETRN

Out: 250-ENHANCEDSTATUSCODES

Out: 250-8BITMIME

Out: 250-DSN

Out: 250 SMTPUTF8

In:  AUTH LOGIN

Out: 503 5.5.1 Error: authentication not enabled

 

Session aborted, reason: lost connection

 

OK, attacker tries to authenticate and receives an error.

 

I see that almost all attacks do not have a valid FQDN, so I have set the
"reject_non_fqdn_helo_hostname" directive in "smtpd_helo_restrictions"
directive, which I see is in a previous phase, to reject it beforehand.

However, it has no effect. The attacks continue to occur in the same way,
and are rejected at the same point.

 

Can you explain to me, why this happens?

 

Best Regards,

Reply via email to