When I look at my sendmail logs, by far the most common "error" I see is the following:
Nov 22 16:49:50 MyHostname sendmail: rAMMnj2u018832: [IP address redacted to hide the guilty] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
This is not coming from poorly configured MUA's inside my small network. It always comes from outside my network, from where only MTA's should be communicating with my sendmail. Overwhelmingly, the single largest source of these IP addresses is China, but plenty of other countries are sources of this as well.
I assume that this must be part of some sort of attempt to hack, but I cannot figure what it is. Is this coming from hackers/scripts that connect to port 25, figure out that my sendmail isn't a combination of MTA/OS/version that they can crack into, and disconnect without doing anything? (If that's it, why do they connect repeatedly?) Or is something else going on? While I have fail2ban running, and I see regular bans occur, is there anything else to do about this? For context, the OS is Fedora 19.
Note: What especially confuses me about this is that I typically see many of this in a row from the same IP address. I almost never see this just once from a given IP address. I've even been "attacked" in this way, before, by multiple servers in the same subnet ... after each one gets banned (via fail2ban), they just move to the next server in the same /24 subnet. I finally changed my sendmail fail2ban rule to ban a whole /24 subnet instead of just a single IP address -- just to cut down on the noise. If this were just a "checking in to see if we could exploit" then I'd expect a single knock at the door, not such repeated attempts.
I'm actually tempted to put a 24 hour listen on port 25 -- I get little enough mail that this wouldn't kill me -- just to try to figure out what is going on in these connections. Some days I get dozens of these connections from the same IP address.