But it seems that all the useful information is already shown in the
dovecot log line (unless we want to differentiate SASL vs IMAP auth
failures for some reason).
Eugene
On 17.05.2023 14:06, Wietse Venema via Postfix-users wrote:
Matus UHLAR - fantomas via Postfix-users:
[ Charset ISO-8859-2 converted... ]
On 2023-05-16 at 12:19:03 UTC-0400 (Tue, 16 May 2023 18:19:03 +0200)
V?ctor Rubiella Monfort via Postfix-users <vrubie...@cdmon.com>
is rumored to have said:
For example for imap/pop login failures dovecot log email account
that produces the failure.
On 16.05.23 13:57, Bill Cole via Postfix-users wrote:
If you are using Dovecot for SASL and have auth_verbose enabled in
Dovecot, it will log failures. For failed Postfix authentications, you
will see lines logged by auth-worker in the info log with the
username, remote IP, and failure type.
this is how it looks:
May 17 00:00:08 mail dovecot[20429]: auth-worker(32269):
pam(smbuser,46.148.40.154): pam_authenticate() failed: Authentication failure
(Password mismatch?)
May 17 00:00:10 mail postfix/smtps/smtpd[29904]: warning:
unknown[46.148.40.154]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
it's not easy to pair these two log lines though.
You correlate them on IP address 46.148.40.154 and on time stamp
(00:00:08 is a little before 00:00:10).
Wietse
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
