0

I am running a Postfix - Dovecot - MySQL mail server on my personal Ubuntu dedicated server which I'm hosting it in my home.

Everything is working amazing except the fact that I am getting loads of incoming connection that I can see in /var/log/mail.log and these connections are coming from different IPs all over the world.

It looks like I'm getting DDoS'd and when the connections are kicking in, my internet connection drops for few seconds then it goes back on. It looks like someone is trying to take down my mail server.

Can anyone give me an idea how can I stop this? How can I improve the security of my Ubuntu dedicated machine? Any other advice that you guys can provide? I'm kinda new at this and Google didn't solve my problem.

enter image description here

Improve this question
3
  • How many connections per second/minute/... are you receiving? It is normal that any system connected to the internet is receiving malicious connection attempts from bad guys scanning for vulnerable hosts and default credentials, there is nothing you can do about it. Also make sure you're not acting as an open SMTP relay.
    – Jens Erat
    Jun 8, 2017 at 6:26
  • I am receiving somewhere around 10-15 connections per minute from IPs all over the world. I am pretty sure those are not clients that are using my mail server. I checked with mxtoolbox, and I am not acting as an open SMTP relay. Is this normal?
    – DooMFeaR
    Jun 10, 2017 at 18:40
  • This is likely to be just common spam or Bad guys scanning the Internet. Read through the logs to make sure their mail does not get forwarded outside. Anyway, 10 to 15 connections per minute should hardly be observable on a somewhat decent internet connection.
    – Jens Erat
    Jun 11, 2017 at 6:56

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.