Re: Can sasl/sendmail Report IP Of Failed Access?

2013-06-04 Thread Warren Block
On Tue, 4 Jun 2013, Tim Daneliuk wrote: On 06/04/2013 04:51 PM, Doug Hardie wrote: On 4 June 2013, at 08:47, Tim Daneliuk wrote: I am seeing login dictionary attacks on a FreeBSD mail server being reported. Is there a way to determine the IPs that are doing this so they can be blocked at t

Re: Can sasl/sendmail Report IP Of Failed Access?

2013-06-04 Thread Chris Hill
On Tue, 4 Jun 2013, Doug Hardie wrote: On 4 June 2013, at 08:47, Tim Daneliuk wrote: I am seeing login dictionary attacks on a FreeBSD mail server being reported. Is there a way to determine the IPs that are doing this so they can be blocked at the firewall? auth.log only notes the attempt

Re: Can sasl/sendmail Report IP Of Failed Access?

2013-06-04 Thread Tim Daneliuk
On 06/04/2013 04:51 PM, Doug Hardie wrote: On 4 June 2013, at 08:47, Tim Daneliuk wrote: I am seeing login dictionary attacks on a FreeBSD mail server being reported. Is there a way to determine the IPs that are doing this so they can be blocked at the firewall? auth.log only notes the att

Re: Can sasl/sendmail Report IP Of Failed Access?

2013-06-04 Thread Doug Hardie
On 4 June 2013, at 08:47, Tim Daneliuk wrote: > I am seeing login dictionary attacks on a FreeBSD mail server being > reported. Is there a way to determine the IPs that are doing this > so they can be blocked at the firewall? auth.log only > notes the attempted user name, not the IP of origin

Re: Can sasl/sendmail Report IP Of Failed Access?

2013-06-04 Thread Mark Felder
On Tue, 04 Jun 2013 10:47:16 -0500, Tim Daneliuk wrote: I am seeing login dictionary attacks on a FreeBSD mail server being reported. Is there a way to determine the IPs that are doing this so they can be blocked at the firewall? auth.log only notes the attempted user name, not the IP of o

Re: Can sasl/sendmail Report IP Of Failed Access?

2013-06-04 Thread Waitman Gobble
On Jun 4, 2013 9:00 AM, "Tim Daneliuk" wrote: > > I am seeing login dictionary attacks on a FreeBSD mail server being > reported. Is there a way to determine the IPs that are doing this > so they can be blocked at the firewall? auth.log only > notes the attempted user name, not the IP of origin