Am 21.11.2021 um 19:54 schrieb Jay Hart: > I just stood up a new server running C8 stream, postfix, SA, etc. > > I keep seeing these log entries in maillog and wonder what to about them. I have not been able to find any research documents detailing if > this is a problem nor how to prevent. Any documentation I have seen via web searches talks about configuration issues with > spamass-milter. This to me looks like hackers. I get the same four lines over and over again from different IP addresses and the > pid/socket/id number (26579 in this instance) are always linked. The number is different for each query/probe. The issue has nothing to do with what you call "hackers". The cause is a misconfiguration on your side: take the error message literal. You have Postfix configured to make use of the spamass milter, everytime another system connects to the smtp daemon. > Nov 21 11:56:57 dream postfix/smtpd[26579]: connect from unknown[141.98.10.140] > Nov 21 11:56:57 dream postfix/smtpd[26579]: warning: connect to Milter service unix:/run/spamass-milter/spamass-milter.sock: Permission > denied > Nov 21 11:56:57 dream postfix/smtpd[26579]: discarding EHLO keywords: CHUNKING > Nov 21 11:56:57 dream postfix/smtpd[26579]: disconnect from unknown[141.98.10.140] ehlo=1 auth=0/1 quit=1 commands=2/3 > > What can I try to do to eliminate this? Other than taking up resources I'm not seeing anything else in the logs to show a problem. > Should I be concerned? > > Research has now shown that Redhat/Centos may have changed the default postfix setting. I do see the following parameter set: > smtpd_discard_ehlo_keywords = chunking You are totally on the wrong track. > Sounds like I need to add/set this as 'silent-discard' pseudo keyword to prevent this action from being logged. Wrong. > Thanks in advance on your help and advice! Run "postconf -n" and see where you have defined the spamass milter. Check whether the spamass milter is really running and that the socket is available under /run/spamass-milter/spamass-milter.sock. Given it is bacause the milter runs and has created its socket under that path, check the permissions (unix permissions and SELinux context) of the socket and the full path. Once the root cause is fixed your Postfix will work again as configured. > Jay Alexander