This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Too many failed logins from %UNKNOWNIP% for facility smtp. [WARN-070] messages every day

Hi folks!

i have a problem with our Sophos version 9.5 .

Recently we get many messages about failed logins to smtp facility (See subject line).

It says that some ip tried to login to the smtp server and gets blocked for our defined 3600 seconds.

Curiously we've not defined any foreign networks to be able to login to our sophos nor did we define any unknown users to do so. So where does this come from and how can we solve it?

This thread was automatically locked due to age.

0 reag over 6 years ago

My first guess would be that someone is trying to use the Sophos as a relay. Have a look at Email Protection, SMTP, Relaying that allowed hosts are listed under host-based relaying. I would expect the Sophos to simply drop all connections from other hosts that try to relay.

However, I guess someone with more knowledge will help you out. :)
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 6 years ago

Is the SMTP Proxy in Transparent mode? Have you selected 'Allow authenticated relaying' on the 'Relaying' tab?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Ol Deda over 6 years ago

If you don't use UTM as Email Server, disable "Allow authenticated relaying"
Cancel
Vote Up 0 Vote Down

Cancel
0 Rumak18 over 6 years ago in reply to Ol Deda

Thank you for your help. I guess will deactivate the "Authenticated Relay" setting.
Cancel
Vote Up 0 Vote Down

Cancel
0 Rumak18 over 6 years ago in reply to Rumak18

And...no, there is no smtp proxy.

One more thing...is there a specific log for mails that were sent by "authenticated users"?

@Igivemyselfananswer: No, there isn't, but you can check the smtp log for "from authenticated user" .
Cancel
Vote Up 0 Vote Down

Cancel