Matus UHLAR - fantomas via Postfix-users: [ Charset ISO-8859-2 converted... ] > >On 2023-05-16 at 12:19:03 UTC-0400 (Tue, 16 May 2023 18:19:03 +0200) > >V?ctor Rubiella Monfort via Postfix-users <vrubie...@cdmon.com> > >is rumored to have said: > >>For example for imap/pop login failures dovecot log email account > >>that produces the failure. > > On 16.05.23 13:57, Bill Cole via Postfix-users wrote: > >If you are using Dovecot for SASL and have auth_verbose enabled in > >Dovecot, it will log failures. For failed Postfix authentications, you > >will see lines logged by auth-worker in the info log with the > >username, remote IP, and failure type. > > this is how it looks: > > May 17 00:00:08 mail dovecot[20429]: auth-worker(32269): > pam(smbuser,46.148.40.154): pam_authenticate() failed: Authentication failure > (Password mismatch?) > May 17 00:00:10 mail postfix/smtps/smtpd[29904]: warning: > unknown[46.148.40.154]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 > > it's not easy to pair these two log lines though.
You correlate them on IP address 46.148.40.154 and on time stamp (00:00:08 is a little before 00:00:10). Wietse _______________________________________________ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to postfix-users-le...@postfix.org