Synchronization Service

[SantaPhil]

I noticed that there have been a lot of connections to the Synchronization service, looking at the logs they appear to be probing for entry into the system. Here is a short view of the activity log for that service:

[02/17/21 04:27:35]****************** LOG FILE STARTED *******************
02/17/21 04:27:36 HTTP-IN 1648 172.105.61.249 AUTH GET /jenkins/login HTTP/1.0 0 31
02/17/21 04:27:36 HTTP-IN 1532 172.105.61.249 AUTH GET /manager/html HTTP/1.0 0 77
02/17/21 04:41:52 HTTP-IN 1988 139.162.145.250 AUTH GET /bag2 HTTP/1.1 0 162
02/17/21 05:27:02 HTTP-IN 1252 111.92.81.201 AUTH GET /boaform/admin/formLogin?username=ec8&psd=ec8 HTTP/1.0 0 62
[02/17/21 10:19:52]****************** LOG FILE CLOSED ********************

There are many logs files that are quite a bit longer with many attempts to run all sorts of programs etc...

I stopped the Synchronization service since I do not believe that we use that feature. My question is how secure is the Synchronization service, and if I stop it, will it effect the normal SMTP, POP, IMAP and Webmail operation?

Thanks for your help,

Phil

[MailEnable-Ian]

Hi,

Please see the following for information about the synchronization service: https://www.mailenable.com/documentation/10.0/Enterprise/Synchronization_-_General.html

Disabling the service will not affect SMTP, IMAP POP or web services. Also if you are experiencing invalid auth attempts you can enable the "Abuse Detection and prevention" option which will automatically ban the connecting IP address after 10 invalid auth attempts.

Please see: https://www.mailenable.com/documentation/10.0/Enterprise/Localhost_-_Policies.html