[email protected]: > Anonymous TLS connection established from xxx[yyy]: TLSv1.2 with cipher > ECDHE-RSA-AE > S128-GCM-SHA256 (128/128 bits) > > but that doesn't help much to determine the exact account involved.
Would logging the SASL username help? The Postfix SMTP server logs:
queueid: client=xxx:[yyy], sasl_method=aaa, sasl_username=bbb
You just need to combine records based on the xxx:[yyy].
Wietse
