Re: [SSHGuard-users] Repeaters

[Jos C. <ssh...@cl...>]

On 6-9-20 18:51, Kevin Zheng wrote:
> On 9/6/20 2:51 AM, Jos Chrispijn wrote:
> Can you show some examples of legitimate SMTP sessions, so that we can
> try to see what the differences are?

Of course, here it is:

- - - start - - -

Sep  6 13:30:48 poseidon postfix/smtpd[25472]: connect from 
mxout1-ec2-va.apache.org[3.227.148.255]
Sep  6 13:30:48 poseidon postfix/smtpd[25472]: Trusted TLS connection 
established from mxout1-ec2-va.apache.org[3.227.148.255]: TLSv1.3 with 
cipher TLS_AES_256_GCM_S>
Sep  6 13:30:51 poseidon postfix/policy-spf[25478]: Policy 
action=PREPEND Received-SPF: pass (httpd.apache.org: Sender is 
authorized to use 'users-return-119859-apac>
Sep  6 13:30:51 poseidon postgrey[1002]: action=pass, reason=triplet 
found, delay=486, client_name=mxout1-ec2-va.apache.org, 
client_address=3.227.148.255, sender=use>
Sep  6 13:30:51 poseidon postfix/smtpd[25472]: E0CBFBFC5: 
client=mxout1-ec2-va.apache.org[3.227.148.255]
Sep  6 13:30:52 poseidon postfix/cleanup[25480]: E0CBFBFC5: 
message-id=<109...@ma...>
Sep  6 13:30:52 poseidon opendkim[999]: E0CBFBFC5: 
mxout1-ec2-va.apache.org [3.227.148.255] not internal
Sep  6 13:30:52 poseidon postfix/qmgr[50777]: E0CBFBFC5: 
from=<users-return-119859-apache=clo...@ht...>, 
size=11517, nrcpt=1 (queue active)
Sep  6 13:30:52 poseidon postfix/smtpd[25472]: disconnect from 
mxout1-ec2-va.apache.org[3.227.148.255] ehlo=2 starttls=1 mail=1 rcpt=1 
data=1 quit=1 commands=7
Sep  6 13:30:52 poseidon clamsmtpd[2406]: 10013A: accepted connection 
from: x.x.x.x
Sep  6 13:30:52 poseidon postfix/smtpd[25482]: connect from 
cloudzeeland.nl[x.x.x.x]
Sep  6 13:30:52 poseidon postfix/smtpd[25482]: 5024DBFC6: 
client=cloudzeeland.nl[x.x.x.x], orig_queue_id=E0CBFBFC5, 
orig_client=mxout1-ec2-va.apache.org[3.227.14>
Sep  6 13:30:52 poseidon postfix/cleanup[25480]: 5024DBFC6: 
message-id=<109...@ma...>
Sep  6 13:30:52 poseidon clamsmtpd[2406]: 10013A: 
from=users-return-119859-apache=clo...@ht..., 
to=ap...@cl..., status=CLEAN
Sep  6 13:30:52 poseidon postfix/qmgr[50777]: 5024DBFC6: 
from=<users-return-119859-apache=clo...@ht...>, 
size=11765, nrcpt=1 (queue active)
Sep  6 13:30:52 poseidon postfix/smtp[25481]: E0CBFBFC5: 
to=<xxxxxx@xxxx.xx>, relay=x.x.x.x[x.x.x.x]:10025, delay=3.3, 
delays=3/0.02/0.14/0.14, dsn=2>
Sep  6 13:30:52 poseidon postfix/qmgr[50777]: E0CBFBFC5: removed
Sep  6 13:30:52 poseidon postfix/smtpd[25482]: disconnect from 
cloudzeeland.nl[x.x.x.x] ehlo=1 xforward=2 mail=1 rcpt=1 data=1 quit=1 
commands=7
Sep  6 13:30:59 poseidon postfix/local[25483]: 5024DBFC6: 
to=<jo...@cl...>, orig_to=<xxxxxx@xxxx.xx>, relay=local, 
delay=7.4, delays=0.14/0.01/0/7.2,>
Sep  6 13:30:59 poseidon postfix/qmgr[50777]: 5024DBFC6: removed

- - - end - - -

Best, Jos

-- With both feed on the ground you will never make a step forward