On 30.07.21 22:24, Aleksei Shpakovskii wrote: > Hi, > > To answer the original Hadmut question: I believe that in order to log > both postfix and saslauthd to the same file, you should configure both > of them to use same logging backend (syslog), and configure that > backend to save their logs to the same place. > > However, depending on your server load: if you receive two login > attempts at the same time, then can you distinguish which saslauthd > log line correspond to which postfix line?
We have a high server load and often more than one login attempt at the same time (if measured in seconds). On the other hand, postfix and saslauthd are different processes, and thus can't take a time stamp exactly at the same time, so it is possible, that for a single auth request they do log different times with a difference of one or even two or more secondes difference, especially since things might depend on the ldap servers response time (I'm not sure whether they take the time before or after contacting it). It is even possible that postfix and saslauthd do log in different order. So it is not a trivial and reliable task to match the postfix log (with the client IP address) and the saslauthd logs (with the attempted user name). > > Apparently, you can use nginx as reverse-proxy for smtp connections[1] > (remember to enable XCLIENT in both nginx and postfix configs or your > server might turn into an open relay) - it can strip ssl/starttls and > forward plaintext smtp to postfix, and also check username/password. > As part of configuring it, you need to setup an "http_auth" server[2] > - it receives remote IP, username and password (or MAIL FROM and RCPT > TO email addresses in case remote client decided to send message > without authentication) and tells nginx IP address of postfix server. That's a major change of the setup and might introduce other problems and cause more cpu load. regards Hadmut
