OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: "lost connection after CONNECT" in logs

From: Bokhan Artem (artistacadem.org)
Date: Mon Aug 13 2007 - 12:23:48 CDT


As I see, interruption of "sendmail -bs" doesn't cause these lines are
logged: lost connection after CONNECT from localhost[127.0.0.1],
disconnect from localhost[127.0.0.1]

The postfix is installed in non-default prefix, so "nobody knows" about
location of binaries and conf files... May be some additional
information could help?..

If network sniffer doesn't see these connections, does it mean that
logged lines caused by postfix's internal stuff?

Wietse Venema ?????:
> Artem Bokhan:
>> I've got strange entries in postfix's logs:
>>
>> Aug 13 18:25:41 postfix-mx/smtpd-mx[28394]: connect from
>> localhost[127.0.0.1]
>
> Look for processes that execute "sendmail -bs" and hang up without
> responding to the "220" server greeting.
>
> Wietse