This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Too many failed logins from %UNKNOWNIP% for facility smtp. [WARN-070] messages every day

Hi folks!

i have a problem with our Sophos version 9.5 .

Recently we get many messages about failed logins to smtp facility (See subject line).

It says that some ip tried to login to the smtp server and gets blocked for our defined 3600 seconds.

Curiously we've not defined any foreign networks to be able to login to our sophos nor did we define any unknown users to do so. So where does this come from and how can we solve it?

This thread was automatically locked due to age.

Parents

0 Ol Deda over 6 years ago

If you don't use UTM as Email Server, disable "Allow authenticated relaying"
Cancel
Vote Up 0 Vote Down

Cancel
0 Rumak18 over 6 years ago in reply to Ol Deda

Thank you for your help. I guess will deactivate the "Authenticated Relay" setting.
Cancel
Vote Up 0 Vote Down

Cancel
0 Rumak18 over 6 years ago in reply to Rumak18

And...no, there is no smtp proxy.

One more thing...is there a specific log for mails that were sent by "authenticated users"?

@Igivemyselfananswer: No, there isn't, but you can check the smtp log for "from authenticated user" .
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Rumak18 over 6 years ago in reply to Rumak18

And...no, there is no smtp proxy.

One more thing...is there a specific log for mails that were sent by "authenticated users"?

@Igivemyselfananswer: No, there isn't, but you can check the smtp log for "from authenticated user" .
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data