Matus UHLAR - fantomas via Postfix-users:
[ Charset ISO-8859-2 converted... ]
> >On 2023-05-16 at 12:19:03 UTC-0400 (Tue, 16 May 2023 18:19:03 +0200)
> >V?ctor Rubiella Monfort via Postfix-users <vrubie...@cdmon.com>
> >is rumored to have said:
> >>For example for imap/pop login failures dovecot log email account
> >>that produces the failure.
>
> On 16.05.23 13:57, Bill Cole via Postfix-users wrote:
> >If you are using Dovecot for SASL and have auth_verbose enabled in
> >Dovecot, it will log failures. For failed Postfix authentications, you
> >will see lines logged by auth-worker in the info log with the
> >username, remote IP, and failure type.
>
> this is how it looks:
>
> May 17 00:00:08 mail dovecot[20429]: auth-worker(32269):
> pam(smbuser,46.148.40.154): pam_authenticate() failed: Authentication failure
> (Password mismatch?)
> May 17 00:00:10 mail postfix/smtps/smtpd[29904]: warning:
> unknown[46.148.40.154]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
>
> it's not easy to pair these two log lines though.
You correlate them on IP address 46.148.40.154 and on time stamp
(00:00:08 is a little before 00:00:10).
Wietse
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
