Northwind via Postfix-users: > Hello, > > Is it possible to set mail.log for recording sasl login usernames? > > May 29 06:52:45 mx postfix/smtps/smtpd[3022855]: warning: > unknown[138.185.193.64]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 > May 29 06:52:57 mx postfix/smtpd[3023133]: warning: > unknown[49.156.148.93]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 > May 29 06:53:03 mx postfix/smtps/smtpd[3022864]: warning: > unknown[167.179.45.182]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 > May 29 06:53:07 mx postfix/smtps/smtpd[3022912]: warning: > unknown[165.227.46.18]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 > May 29 06:53:08 mx postfix/smtps/smtpd[3022901]: warning: > unknown[112.199.181.114]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 > May 29 06:53:12 mx postfix/smtpd[3023133]: warning: > unknown[58.23.17.120]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 > May 29 06:53:14 mx postfix/smtps/smtpd[3022912]: warning: > unknown[165.227.46.18]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 > May 29 06:53:19 mx postfix/smtps/smtpd[3022869]: warning: > unknown[58.174.79.124]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 > > For example, for the failed login events above, I want to know what > usernames they happened on.
https://www.postfix.org/announcements/postfix-3.8.3.html Fixed with Postfix 3.8.3, 3.7.8, 3.6.12, 3.5.22: ... * Usability: the Postfix SMTP server (finally) attempts to log the SASL username after authentication failure. In Postfix logging, this appends ", sasl_username=xxx" after the reason for SASL authentication failure. The logging replaces an unavailable reason with "(reason unavailable)", and replaces an unavailable sasl_username with "(unavailable)". Based on code by Jozsef Kadlecsik. ... Wietse _______________________________________________ Postfix-users mailing list -- [email protected] To unsubscribe send an email to [email protected]
