Hello,

I am running on Centos 5, a classic postfix email server,

I am getting a lot of entries like this one in/var/log/maillog

Dec 22 11:10:43 li21-231 postfix/smtpd[32045]: NOQUEUE: reject: RCPT from unknown[175.180.76.219]: 504 5.5.2 <f-225224966f204>: Helo command rejected: need fully-qualified hostname; from=<info@xxxxxx.com> to=<a901065@yahoo.com.tw> proto=ESMTP helo=<f-225224966f204>

I don't quite understand what is going on? If someone could educate me a little bit that would be great.

Than you!

Someone tried to use your mailserver to relay a message to someone at yahoo.com.tw, but you rejected it because they did not give a complete hostname in their HELO.

It is good that you rejected it, and it is quite normal to see lots of attempts like this - nothing to worry about.

That's good to hear!

This maillog file is getting really big:

6.9G maillog
27M maillog.2
27M maillog.3
27M maillog.4

and I had to delete stuff in order to keep my linode up and running.

What would be a good strategy to reduce the size of that log. I mean that log is an important one and I don't think I can delete it but the more I am getting hit by those guys the more it grows...

Use logrotate. It is usually installed by default, but may not be for you. Try googling for examples of usage and configuration, there are many pages like http://linuxnextgen.blogspot.ca/2011/04 ... linux.html

_________________
sleddog

Good, I am looking into that tool. Thanks. With this tool I will handle the size of my log properly. But the continuous flow will not stop... I changed the MX record associated with info@xxxxxx.com to nothing (I just deleted hat record from the zone) but the requests keep coming.
What could be done?

If you're seeing lots of attempts from small number of sites then something like fail2ban can be used to automatically firewall off these people (eg 5 failed relay attempts in a few seconds -> firewall entry).

_________________
Rgds
Stephen
(Linux user since kernel version 0.11)