Paul Schmehl via Postfix-users:
> >>> - Did the client send starttls? That is logged in the "disconnect
> >>> from" line.
> >>>
> >>
> >> I don't see anything in the postfix logs (/var/log/maillog) from
> >> roundcube. I guess I need to enable debug.
> >
> > No debug logging needed. This information is ALWAYS logged:
> >
> > Example of client that sends starttls:
> > disconnect from host[addr] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1
> > commands=7
>
> When I grep for 'disconnect from' I get 118,816 entries in the
> log. 20,297 of those are from one IP.
>
> When I look in the logs for the timestamp that is in the roundcube
> smtp log, I find nothing.
Yeah. Are your clocks properly synchronized, like NTP? Or do you
use whatever the clock on the motherboard says?
> [17-Jun-2024 15:24:58 -0500]: <so35oiot> Recv: 220 mail.stovebolt.com ESMTP
> Postfix
[successsful auth, mail, rcpt, data and so on.]
Clearly you solved a problem by June 17.
> So, that's one session in Roundcube. There should be a corresponding entry in
> the maillog, right?
>
> grep "15:24:5" /var/log/maillog
You can do that only if your clocks are accurate to within two seconds,
otherwise it could already be 15:25:0* on the host that runs Postfix.
> Jun 16 15:24:57 ded602 postfix/smtpd[11420]: disconnect from
> unknown[80.244.11.148] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
That was on June 16, an example of a client that did not send
STARTTLS, and that sent AUTH but failed (0 successful of 1 attempts).
It then sent RSET and QUIT.
Clearly, a different session than the successful one above.
Wietse
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
