Re: Best current practice to analyze brute force login attempts?

2021-07-31 Thread raf
On Sat, Jul 31, 2021 at 03:59:07PM +0200, Hadmut Danisch wrote: > On 30.07.21 23:09, Wietse Venema wrote: > > This is not needed. Postfix 3.0 and later log the AUTH failure AND > > the client IP address together: > > > > postfix/smtpd[xxx]: disconnect from unknown[x.x.x.x] auth=0/1 > > comm

Re: reject_sender_login_mismatch

2021-07-31 Thread Simon Wilson
- Message from Wietse Venema - Date: Sat, 31 Jul 2021 09:45:00 -0400 (EDT) From: Wietse Venema Reply-To: Postfix users Subject: Re: reject_sender_login_mismatch To: Postfix users Simon Wilson: A quick query on?smtpd_sender_login_maps format. I have this working

Re: recipient_delimiter and virtual_alias_maps

2021-07-31 Thread Florian Hars
On 31.07.21 20:55, Wietse Venema wrote: > Please also provide output from > > postconf -P There is only syslog and submission stuff in postconf -P. The true problem seems to have been that I didn't delete the verify_cache.db after changing the virtual alias map. - Florian.

Re: recipient_delimiter and virtual_alias_maps

2021-07-31 Thread Wietse Venema
Florian Hars: > On 31.07.21 16:10, Florian Hars wrote: > > I am currently slightly confused by the interaction between > > recipient_delimiter and virtual_alias_maps. > > That interaction may actually not have been the true cause of my > observations. What I now think happened is that the effects

Re: recipient_delimiter and virtual_alias_maps

2021-07-31 Thread Florian Hars
On 31.07.21 16:10, Florian Hars wrote: > I am currently slightly confused by the interaction between > recipient_delimiter and virtual_alias_maps. That interaction may actually not have been the true cause of my observations. What I now think happened is that the effects I observed were caused by

Re: recipient_delimiter and virtual_alias_maps

2021-07-31 Thread Wietse Venema
Please also provide output from postconf -P I suspect that you have virtual alias mapping disabled in some message delivery path (with receive_override_options = no_address_mappings). Wietse

Re: Best current practice to analyze brute force login attempts?

2021-07-31 Thread Wietse Venema
Hadmut Danisch: > Is there a way to make postfix tell in the logs whether someone > authenticated on port 25 or 587? Yes. Configure master.cf thusly: master.cf: smtp inet ...... ... ... ... smtpd submission inet ...... ... ... ... smtpd

Re: Best current practice to analyze brute force login attempts?

2021-07-31 Thread Wietse Venema
Hadmut Danisch: > > On 30.07.21 23:09, Wietse Venema wrote: > > This is not needed. Postfix 3.0 and later log the AUTH failure AND > > the client IP address together: > > > > postfix/smtpd[xxx]: disconnect from unknown[x.x.x.x] auth=0/1 > > commands=0/1 > > > > This is logged even when AUTH i

recipient_delimiter and virtual_alias_maps

2021-07-31 Thread Florian Hars
Hi, I am currently slightly confused by the interaction between recipient_delimiter and virtual_alias_maps. I have a test setup with recipient_delimiter = + virtual_alias_maps = hash:/etc/postfix/virtual virtual_transport = lmtp:unix:private/dovecot-lmtp a virtual domain "domain" and an alias a

Re: Best current practice to analyze brute force login attempts?

2021-07-31 Thread Hadmut Danisch
On 30.07.21 23:09, Wietse Venema wrote: > This is not needed. Postfix 3.0 and later log the AUTH failure AND > the client IP address together: > > postfix/smtpd[xxx]: disconnect from unknown[x.x.x.x] auth=0/1 commands=0/1 > > This is logged even when AUTH is disabled (as it should be on port

Re: Best current practice to analyze brute force login attempts?

2021-07-31 Thread Hadmut Danisch
On 30.07.21 23:26, Jaroslaw Rafa wrote: > Well, maybe I'm using quite old versions of Postfix and Dovecot, but with > default logging setup on Debian plus "auth_verbose=yes" in Dovecot config I > get in /var/log/mail.log lines like: Well, as I said, we're using postfix + saslauthd, and not dove

Re: reject_sender_login_mismatch

2021-07-31 Thread Wietse Venema
Simon Wilson: > A quick query on?smtpd_sender_login_maps format. > > I have this working well on port 587 to ensure that specified > SASL-authenticated users only can send emails from their owned email > addresses. > > So I have in a file 'controlled_envelope_senders' this, as an example: >

Re: Best current practice to analyze brute force login attempts?

2021-07-31 Thread Hadmut Danisch
On 30.07.21 22:24, Aleksei Shpakovskii wrote: > Hi, > > To answer the original Hadmut question: I believe that in order to log > both postfix and saslauthd to the same file, you should configure both > of them to use same logging backend (syslog), and configure that > backend to save their logs to

Re: reject_sender_login_mismatch

2021-07-31 Thread Simon Wilson
- Message from tobi - Date: Sat, 31 Jul 2021 06:49:48 + From: tobi Subject: Re: reject_sender_login_mismatch To: postfix-users@postfix.org you could add a sender access map in your relay config which rejects those domains. Place it before your sender login maps