rejected commands from localhost due to pre-greeting traffic

[Steve Freegard]

Johnny Stork wrote:
> Thanks again. Did all the suggested steps and although that original 
> message is gone, it seems to have been replaced by these....
> 
> localhost.localdomain [127.0.0.1] did not issue MAIL/EXPN/VRFY/ETRN 
> during connection to MTA
> 

Are you running Nagios or some sort of other monitoring locally?

It seems that something is connecting to port 25 and maybe even issuing 
a HELO/EHLO and then disconnecting.

I've seen this happen with some monitoring tools before, if you don't 
run any or have not carried out any work on this machine recently then 
you should probably check for rootkits or other nasties and make sure 
you don't have any weak root or user passwords as malware could case 
this as well.

Cheers,
Steve.