DevHeads.net

Connections from "unknown"

Hello,

I noticed something interesting in my logs today. I am running Postfix 3.3.1:

Aug 24 21:09:25 server postfix/submission/smtpd[10256]: connect from unknown[unknown]:unknown
Aug 24 21:09:25 server postfix/submission/smtpd[10256]: lost connection after CONNECT from unknown[unknown]:unknown
Aug 24 21:09:25 server postfix/submission/smtpd[10256]: disconnect from unknown[unknown]:unknown commands=0/0

It is clear that this was a bad connection, but under what circumstances does Postfix consider a remote connection’s address as “unknown” ? Wouldn’t Postfix always know the remote IPv4/IPv6 address because when a client connects to the server the address is passed from the OS to Postfix ?

Thanks,

- J

Comments

Re: Connections from "unknown"

By Wietse Venema at 08/25/2018 - 07:46

J Doe:
"unknown" clients are defined in
<a href="http://www.postfix.org/postconf.5.html#reject_unknown_client_hostname" title="http://www.postfix.org/postconf.5.html#reject_unknown_client_hostname">http://www.postfix.org/postconf.5.html#reject_unknown_client_hostname</a>

reject_unknown_client_hostname (with Postfix < 2.3: reject_unknown_client)

Reject the request when 1) the client IP address->name mapping
fails, or 2) the name->address mapping fails, or 3) the
name->address mapping does not match the client IP address.

Wietse

Re: Connections from "unknown"

By Wietse Venema at 08/25/2018 - 07:48

Wietse Venema:
The "unknown" address means that the connection was already closed
when Postfix asked the OS for the client IP address.

Wietse