NethServer Version: 7.8.2003
Module: rspamd
Is it normal to have logs full infos about rspamd getting connections from the outside even if it is not supposed to listen to other than localhost ?
Is possible to see sample of these logs? On Discourse…
Of course:
Sep 26 19:44:39 admin rspamd[17729]: <a9854f>; milter; rspamd_milter_process_command: got connection from 212.70.149.83:28522
Sep 26 19:44:39 admin rspamd[17729]: <a9854f>; proxy; proxy_milter_finish_handler: finished milter connection
Sep 26 19:44:40 admin rspamd[17729]: <538358>; proxy; proxy_accept_socket: accepted milter connection from /var/run/rspamd/worker-proxy port 0
Sep 26 19:44:43 admin rspamd[17729]: <f945dc>; milter; rspamd_milter_process_command: got connection from 212.70.149.20:7274
Sep 26 19:44:43 admin rspamd[17729]: <f945dc>; proxy; proxy_milter_finish_handler: finished milter connection
Sep 26 19:44:45 admin rspamd[17729]: <538358>; milter; rspamd_milter_process_command: got connection from 212.70.149.52:57208
Sep 26 19:44:45 admin rspamd[17729]: <538358>; proxy; proxy_milter_finish_handler: finished milter connection
Sep 26 20:00:07 admin rspamd[17729]: <0b45d2>; proxy; proxy_accept_socket: accepted milter connection from /var/run/rspamd/worker-proxy port 0
Sep 26 20:05:07 admin rspamd[17729]: <0b45d2>; milter; rspamd_milter_process_command: got connection from 212.70.149.83:55784
Sep 26 20:05:07 admin rspamd[17729]: <0b45d2>; proxy; proxy_milter_finish_handler: finished milter connection
Thank you
rspamd scans messages itself and talk to MTA directly using Milter protocol
https://rspamd.com/doc/workers/rspamd_proxy.html#self-scan-mode
you can follow a transaction by sorting with the rspamd ID : <0b45d2>
Thank you 
1 Like