OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: "lost connection after CONNECT" in logs

From: Wietse Venema (wietseporcupine.org)
Date: Mon Aug 13 2007 - 13:07:02 CDT


Bokhan Artem:
> As I see, interruption of "sendmail -bs" doesn't cause these lines are
> logged: lost connection after CONNECT from localhost[127.0.0.1],
> disconnect from localhost[127.0.0.1]

% sendmail -bs </dev/null
220 hades.porcupine.org ESMTP Postfix
% tail -3 /var/log/maillog
Aug 13 14:05:20 hades postfix/smtpd[2059]: connect from localhost[127.0.0.1]
Aug 13 14:05:20 hades postfix/smtpd[2059]: lost connection after CONNECT from localhost[127.0.0.1]
Aug 13 14:05:20 hades postfix/smtpd[2059]: disconnect from localhost[127.0.0.1]

Of course the same happens when some process invokes "sendmail -bs"
and crashes or otherwise closes the pipe to the smtpd process.

        Wietse

> The postfix is installed in non-default prefix, so "nobody knows" about
> location of binaries and conf files... May be some additional
> information could help?..
>
> If network sniffer doesn't see these connections, does it mean that
> logged lines caused by postfix's internal stuff?
>
> Wietse Venema ?????:
> > Artem Bokhan:
> >> I've got strange entries in postfix's logs:
> >>
> >> Aug 13 18:25:41 postfix-mx/smtpd-mx[28394]: connect from
> >> localhost[127.0.0.1]
> >
> > Look for processes that execute "sendmail -bs" and hang up without
> > responding to the "220" server greeting.
> >
> > Wietse
>
>
>