Can sasl/sendmail Report IP Of Failed Access?

2013-06-04 Thread Tim Daneliuk
I am seeing login dictionary attacks on a FreeBSD mail server being reported. Is there a way to determine the IPs that are doing this so they can be blocked at the firewall? auth.log only notes the attempted user name, not the IP of origin. --

Re: Can sasl/sendmail Report IP Of Failed Access?

2013-06-04 Thread Waitman Gobble
On Jun 4, 2013 9:00 AM, Tim Daneliuk tun...@tundraware.com wrote: I am seeing login dictionary attacks on a FreeBSD mail server being reported. Is there a way to determine the IPs that are doing this so they can be blocked at the firewall? auth.log only notes the attempted user name, not

Re: Can sasl/sendmail Report IP Of Failed Access?

2013-06-04 Thread Mark Felder
On Tue, 04 Jun 2013 10:47:16 -0500, Tim Daneliuk tun...@tundraware.com wrote: I am seeing login dictionary attacks on a FreeBSD mail server being reported. Is there a way to determine the IPs that are doing this so they can be blocked at the firewall? auth.log only notes the attempted user

Re: Can sasl/sendmail Report IP Of Failed Access?

2013-06-04 Thread Doug Hardie
On 4 June 2013, at 08:47, Tim Daneliuk tun...@tundraware.com wrote: I am seeing login dictionary attacks on a FreeBSD mail server being reported. Is there a way to determine the IPs that are doing this so they can be blocked at the firewall? auth.log only notes the attempted user name,

Re: Can sasl/sendmail Report IP Of Failed Access?

2013-06-04 Thread Tim Daneliuk
On 06/04/2013 04:51 PM, Doug Hardie wrote: On 4 June 2013, at 08:47, Tim Daneliuk tun...@tundraware.com wrote: I am seeing login dictionary attacks on a FreeBSD mail server being reported. Is there a way to determine the IPs that are doing this so they can be blocked at the firewall?

Re: Can sasl/sendmail Report IP Of Failed Access?

2013-06-04 Thread Chris Hill
On Tue, 4 Jun 2013, Doug Hardie wrote: On 4 June 2013, at 08:47, Tim Daneliuk tun...@tundraware.com wrote: I am seeing login dictionary attacks on a FreeBSD mail server being reported. Is there a way to determine the IPs that are doing this so they can be blocked at the firewall? auth.log

Re: Can sasl/sendmail Report IP Of Failed Access?

2013-06-04 Thread Warren Block
On Tue, 4 Jun 2013, Tim Daneliuk wrote: On 06/04/2013 04:51 PM, Doug Hardie wrote: On 4 June 2013, at 08:47, Tim Daneliuk tun...@tundraware.com wrote: I am seeing login dictionary attacks on a FreeBSD mail server being reported. Is there a way to determine the IPs that are doing this so