How can I stop an IP from trying to use my mail server?

Question

I have recently set up my first email server, and I look at the logs in /var/logs/mail.log to see what is happening, I notice this one IP does this multiple times every day for the last so many weeks :

May 15 19:44:36 rpi postfix/smtpd[14538]: NOQUEUE: reject: RCPT from unknown[91.236.75.224]: 504 5.5.2 <#MYIP#>: Helo command
rejected: need fully-qualified hostname; from=<smtp2001soho@yahoo.com> to=<m_luzhkov@freemailhost.ru> proto=SMTP helo=<#MYIP#>

May 17 16:01:48 rpi postfix/smtpd[16889]: NOQUEUE: reject: RCPT from unknown[91.236.75.224]: 504 5.5.2 <#MYIP#>: Helo command
rejected: need fully-qualified hostname; from=<smtp2001soho@yahoo.com> to=<m_luzhkov@freemailhost.ru> proto=SMTP helo=<#MYIP#>

May 19 13:41:38 rpi postfix/smtpd[19313]: NOQUEUE: reject: RCPT from unknown[91.236.75.224]: 504 5.5.2 <#MYIP#>: Helo command
rejected: need fully-qualified hostname; from=<smtp2001soho@yahoo.com> to=<m_luzhkov@freemailhost.ru> proto=SMTP helo=<#MYIP#>

Its always like that. My questions are :

1. Is this in any way a threat?
2. How can I stop this person?
3. If I cannot STOP this person, is there some sort of complaint I can file online?

I apologise if this is not the right place to ask such a question. If that is the case please point me to the relevant forum.

Answer 1

Regarding security, usually such connection attempts are just made by automated spam bots operating from malware contaminated PC. In all case it seems that these requests are correctly rejected by your server.

I recommend you to check SPAM protection measures to protect your mail server, and in particular I recommend you to setup a check toward SpamHaus database.

In particular, SpamHaus offers you two interesting systems:

• The SpamHaus Block List (SBL) is a downloadable list of IP ranges either known to be owned by illegal organizations or which are not used by their owner and may therefore be used for illegitimate purposes. This list is to be used at your firewall level to directly drop corresponding traffic no matter the protocol since it will most probably be illegitimate traffic. The IP you mentions in your question is flagged by this list.

• SpamHaus also offer lists dedicated to mail serves which can be queried upon each request by your mail server in order to provide more fine-grained filtering. These lists do not necessary correspond to illegitimate traffic, for instance IP ranges associated to end-user internet accesses are listed (usually this correspond to malware's spam, but it may also indicate someone having built a genuine email server at home), so it may require a bit of tunning to determine which list your need and how you may want your server to react exactly.

I strongly recommend to at least set up your server to use the SBL list to block traffic involving the IP it contains, and automate a daily update of this list.

Answer 2

• Is this in any way a threat?

No. Your server correctly rejects the mails before they reach your server (the spammer only greeted), so only minimal resources are used and you can just ignore it.

---

• How can I stop this person?

By blocking such attempts if they do it too often, e.g. using fail2ban, which you can install via package management. It is used on most server systems to stop such attacks. You can use this rule for this case:

 failregex = reject: RCPT from (.*)\[<HOST>\]: 504 5.5.2

You can also add more error codes. Also see this answer on Serverfault: Email server attack from telnet

---

• If I cannot STOP this person, is there some sort of complaint I can file online?

You will always find abuse mail addresses in the whois for the IP, in your case it's abuse@szara.net. But this is not very effective in most cases, so I recommend using fail2ban and ignoring.

Answer 3

It's probably a machine trying to use your mailserver to send spam. To answer your questions:

1. The risk for you here is that, if he succeeds, your mailserver is going to be blacklisted as an Open Relay.

2. You must configure your mailserver to accept connections on port 25 only from the hosts you want to be able to send mail. As an additional protection, you can also configure your firewall in a similar way.

3. Theoretically you could try to track this IP up to his ISP and file a complaint to the latter, but it's a waste of time.

Answer 4

These records show that this sender is trying to relay mail through your mail server. But fortunately, your mail server is not setup to allow open relaying, so that's preventing these attempts from succeeding.

If this mail server is only being used to send outgoing mail, and is not being used to receive incoming mail, then you may want to setup your firewall to block all incoming connections on port 25, except for hosts that you are specifically allowing to send through this server, and that will stop these attempts from reaching your mail server.