Suddenly, starting yesterday, in the logwatch report, I am seeing loads and loads of failed attempts to log in on port 25. Port 25 is, of course, open to receive mail, but nobody should be using it to log in. And as far as I was aware, they haven’t been until yesterday.
This appears to be a new issue. Has sonething changed?
And the next day’s logwatch report had none. Even more puzzling.
There’s nothing worrying here - it’s just standard scanning from being on the internet.
Most spam now comes via compromised email accounts, so if you look across enough servers you’ll find this very common.
It’s not the incoming spam that concerns me. We seem to have mostly got spam tamed.
It’s that authenticated connections are being tried. Why was the server even allowing clients to try to authenticate on 25?
And why only the day before yesterday?
Because the server allows that as a fallback in case of client issues, and you’re on the internet!
You probably don’t want to know what failed login attempts a multi-server mail platform gets from all over the internet, all day, every day.
Because it was just your turn on the big list of all IPs on the internet - it’s simply a case of giving a botnet script a list of usernames and passwords to try, and it will go over them on every IP, and report the ones it managed to log in with.
A few decades ago, you’d see the exact same thing with IPs attempting to send mail though a server as a relay. Those are mostly gone, so it’s now looking for compromised email address and password combinations, or just obvious usernames and passwords.
Well, until we closed 587, there were between 4,000 and 10,000 failed login attempts every day. But not attempts on 25