[SOLVED] Where are the Failed logins?

[ukro]

Greetings,
i had this logs on my mail server before a added PMG:

[24/Sep/2021 20:33:47] Failed SMTP login from 2.56.59.87 with SASL method DIGEST-MD5.
[24/Sep/2021 20:34:17] Failed SMTP login from 45.144.225.205 with SASL method CRAM-MD5.
[24/Sep/2021 20:34:20] Failed SMTP login from 45.144.225.205 with SASL method DIGEST-MD5.
[24/Sep/2021 20:34:37] Failed SMTP login from 45.144.225.206 with SASL method CRAM-MD5.
[24/Sep/2021 20:34:40] Failed SMTP login from 45.144.225.206 with SASL method DIGEST-MD5.
[24/Sep/2021 20:35:39] Failed SMTP login from 2.56.59.40 with SASL method CRAM-MD5.
[24/Sep/2021 20:35:42] Failed SMTP login from 2.56.59.40 with SASL method DIGEST-MD5.
[24/Sep/2021 20:36:14] Failed SMTP login from 136.144.41.70 with SASL method CRAM-MD5.
[24/Sep/2021 20:36:17] Failed SMTP login from 136.144.41.70 with SASL method DIGEST-MD5.
[24/Sep/2021 20:37:13] Failed SMTP login from 31.210.20.54 with SASL method CRAM-MD5.
[24/Sep/2021 20:37:17] Failed SMTP login from 31.210.20.54 with SASL method DIGEST-MD5.
[24/Sep/2021 20:37:37] Failed SMTP login from 37.0.10.49 with SASL method CRAM-MD5.
[24/Sep/2021 20:37:40] Failed SMTP login from 37.0.10.49 with SASL method DIGEST-MD5.
[24/Sep/2021 20:38:33] Failed SMTP login from 37.0.8.132 with SASL method CRAM-MD5.
[24/Sep/2021 20:38:36] Failed SMTP login from 37.0.8.132 with SASL method DIGEST-MD5.
[24/Sep/2021 20:41:35] SMTP: Invalid password for user xxxx@xxxxx. Attempt from IP address 156.96.157.102.
[24/Sep/2021 20:41:35] Account lockout - user xxxx@xxxx will be blocked for connections from IP address 156.96.157.102 for 1440 minutes: too many failed logins from this IP address
[24/Sep/2021 20:46:10] Failed SMTP login from 45.133.1.50 with SASL method CRAM-MD5.
[24/Sep/2021 20:46:13] Failed SMTP login from 45.133.1.50 with SASL method DIGEST-MD5.
[24/Sep/2021 20:47:31] SMTP Spam attack detected from 77.247.110.249, client closed connection before SMTP greeting
[24/Sep/2021 20:48:57] Failed SMTP login from 136.144.41.87 with SASL method CRAM-MD5.
[24/Sep/2021 20:49:00] Failed SMTP login from 136.144.41.87 with SASL method DIGEST-MD5.
[24/Sep/2021 20:53:14] Failed SMTP login from 45.144.225.204 with SASL method CRAM-MD5.
[24/Sep/2021 20:53:17] Failed SMTP login from 45.144.225.204 with SASL method DIGEST-MD5.

Now its crystal clear, no further logs like this after adding PMG.
What happened? The port 25 PGM is not allowing to pass to my mail server?

 

[ukro]

nvm it started again, so i guess the logs are wrong and its not SMTP 25, its secure SMTP

[24/Sep/2021 22:02:18] SMTP: Invalid password for user xxxxx. Attempt from IP address 156.96.157.102.
[24/Sep/2021 22:02:18] Account lockout - user xxxxx will be blocked for connections from IP address 156.96.157.102 for 1440 minutes: too many failed logins from this IP address
[24/Sep/2021 22:02:31] Failed SMTP login from 156.96.157.102 with SASL method LOGIN.

 

[Stoiko Ivanov]

[24/Sep/2021 20:33:47] Failed SMTP login from 2.56.59.87 with SASL method DIGEST-MD5.

This looks like someone tried to authenticated to your SMTP-server (with SASL authentication) - PMG does not offer SMTPAUTH - so it's just not possible to authenticate to PMG - and PMG is not a 'transparent proxy' in the sense that it passes all smtp-commands to your downstream server
it accepts mail (unless the mail is blocked by your rules) and then starts a smtp-session of its own with your downstream server to pass the mail along

So I'm not quite sure what the issue for you here is?

 

[ukro]

This looks like someone tried to authenticated to your SMTP-server (with SASL authentication) - PMG does not offer SMTPAUTH - so it's just not possible to authenticate to PMG - and PMG is not a 'transparent proxy' in the sense that it passes all smtp-commands to your downstream server
it accepts mail (unless the mail is blocked by your rules) and then starts a smtp-session of its own with your downstream server to pass the mail along

So I'm not quite sure what the issue for you here is?

I am sorry, that was not port 25 but secure smtp. So its fine.
PMG does not offer SMTPAUTH this is awesome news !! Thank you very much! <3