I have a couple of messages appearing in my Postfix mail logs every day, like:

postfix/smtpd[7363]: warning: non-SMTP command from unknown[xx.xx.xx.xx]: GET / HTTP/1.0

Should I ignore them or block? If it is necessary block these attempts what is the best way to do this (iptables, postfix access maps, etc)?


I use fail2ban. You can edit /etc/fail2ban/filter.d/postfix.conf to catch any further attempts. I monitor my /var/log/mail.log files to look for suspicious behaviour and add to postfix.conf as required. Here is my postfix.conf which does catch the line you mention above.


before = common.conf


_daemon = postfix/smtpd

failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
        ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo       command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
        ^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$
        ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 454 4\.7\.1 :*$
        reject: RCPT from (.*)\[<HOST>\]: 550 5.1.1
        reject: RCPT from (.*)\[<HOST>\]: 450 4.7.1
        reject: RCPT from (.*)\[<HOST>\]: 554 5.7.1
    reject: RCPT from unknown\[<HOST>\]: 454 4.7.1
    connect from unknown\[<HOST>\]

ignoreregex = 

you could also add

warning: non-SMTP command from unknown\[<HOST>\]:: GET / HTTP/1.0

if the above does not catch all.

If you wish to ban historical IP addresses manually then use IP tables.

Regards and good luck,


| improve this answer | |

There is no need to block "the command". If you find that someone is doing a ton of invalid commands block that IP address. A invalid command won't hurt anything, and is in some cases practical (i.e. supporting buggy clients).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.