It do log from=. Default config from debian: root@linuxlite-desktop:/var/log# grep NOQUEUE syslog.1 Jan 15 11:12:37 linuxlite-desktop postfix/smtpd[31407]: NOQUEUE: reject: RCPT from unknown[202.12.83.69]: 554 5.7.1 <sebast...@sebbe.eu>: Sender address rejected: Access denied; from=<sebast...@sebbe.eu> to=<sebast...@sebbe.eu> proto=ESMTP helo=<202-12-83-69-dynamic.mangalore.cscnet.in> Jan 15 11:12:42 linuxlite-desktop postfix/smtpd[31409]: NOQUEUE: reject: RCPT from unknown[202.12.83.69]: 554 5.7.1 <sebast...@sebbe.eu>: Sender address rejected: Access denied; from=<sebast...@sebbe.eu> to=<sebast...@sebbe.eu> proto=ESMTP helo=<202-12-83-69-dynamic.mangalore.cscnet.in> Jan 15 12:57:05 linuxlite-desktop postfix/smtpd[32440]: NOQUEUE: reject: RCPT from 1-160-42-66.dynamic.hinet.net[1.160.42.66]: 554 5.7.1 <g...@linwayedm.com.tw>: Relay access denied; from=<d...@email.cta.cq.cnt> to=<g...@linwayedm.com.tw> proto=SMTP helo=<46.227.69.210> Jan 15 14:28:40 linuxlite-desktop postfix/smtpd[956]: NOQUEUE: reject: RCPT from unknown[114.130.4.61]: 554 5.7.1 <eax...@yahoo.com>: Relay access denied; from=<x...@ore.net> to=<eax...@yahoo.com> proto=ESMTP helo=<192.168.0.137> Jan 15 16:15:46 linuxlite-desktop postfix/smtpd[2263]: NOQUEUE: reject: RCPT from 111-251-109-66.dynamic.hinet.net[111.251.109.66]: 554 5.7.1 <g...@linwayedm.com.tw>: Relay access denied; from=<d...@email.cta.cq.cnt> to=<g...@linwayedm.com.tw> proto=SMTP helo=<46.227.69.210> Jan 15 19:52:43 linuxlite-desktop postfix/smtpd[4638]: NOQUEUE: reject: RCPT from 1-160-42-242.dynamic.hinet.net[1.160.42.242]: 554 5.7.1 <g...@linwayedm.com.tw>: Relay access denied; from=<d...@email.cta.cq.cnt> to=<g...@linwayedm.com.tw> proto=SMTP helo=<46.227.69.210> Jan 16 00:16:50 linuxlite-desktop postfix/smtpd[7278]: NOQUEUE: reject: RCPT from 1-162-232-106.dynamic.hinet.net[1.162.232.106]: 554 5.7.1 <g...@linwayedm.com.tw>: Relay access denied; from=<d...@email.cta.cq.cnt> to=<g...@linwayedm.com.tw> proto=SMTP helo=<46.227.69.210> Jan 16 00:32:10 linuxlite-desktop postfix/smtpd[7443]: NOQUEUE: reject: RCPT from 24-54-48-245.sh.cgocable.ca[24.54.48.245]: 554 5.7.1 <eax...@yahoo.com>: Relay access denied; from=<x...@ore.net> to=<eax...@yahoo.com> proto=ESMTP helo=<192.168.0.247> Jan 16 05:50:33 linuxlite-desktop postfix/smtpd[11103]: NOQUEUE: reject: RCPT from 111-251-103-173.dynamic.hinet.net[111.251.103.173]: 554 5.7.1 <g...@linwayedm.com.tw>: Relay access denied; from=<d...@email.cta.cq.cnt> to=<g...@linwayedm.com.tw> proto=SMTP helo=<46.227.69.210> root@linuxlite-desktop:/var/log#
-----Ursprungligt meddelande----- Från: owner-postfix-us...@postfix.org [mailto:owner-postfix-us...@postfix.org] För Christian Ro¨ßner Skickat: den 16 januari 2017 14:59 Till: Postfix users <postfix-users@postfix.org> Ämne: [Feature-request for 3.2] log from= in postfix/smtp - or looking for unknown option [invalid signature!] Hi, I have looked at man 5 postconf, if there exists an option to add the envelope sender to the postfix smtp client, but I didn'T find one. If an account gets stolen and this account starts sending lots of mails, it often leads to RBLs. If you try to find the account that was compromised, a first command would be something like: grep "postfix/smtp\[" mail.log | grep -i reject which will only give you thousands of queue-IDs. But this makes it harder to dive deeper in searching for the compromised account, as you can not simply enhance bash commands and sort for the from= filed (because it does not exist). Therefor I ask, if it is possible to add this little feature to 3.2 (if not already frozen code). Thanks in advance Christian Rößner -- Erlenwiese 14, 36304 Alsfeld T: +49 6631 78823400, F: +49 6631 78823409, M: +49 171 9905345
smime.p7s
Description: S/MIME Cryptographic Signature
