Kiss Gabor (Bitman):
> My logs are fullfilled with this:
>
> Jan 20 20:05:26 linzer postfix/smtpd[22308]: warning: hostname
> c942452695-cloudp
> ro-214859053.cloudatcost.com does not resolve to address 167.88.40.162: Name
> or
> service not known
> Jan 20 20:05:26 linzer postfix/smtpd[22308]: connect from
> unknown[167.88.40.162]
> Jan 20 20:05:28 linzer postfix/smtpd[22308]: warning: unknown[167.88.40.162]:
> SA
> SL login authentication failed: authentication failure
> Jan 20 20:05:29 linzer postfix/smtpd[22308]: lost connection after AUTH from
> unk
> nown[167.88.40.162]
> Jan 20 20:05:29 linzer postfix/smtpd[22308]: disconnect from
> unknown[167.88.40.1
> 62]
>
> Is there any way to know what username was used in these attempts.
> (An existing one every time or they are choosen from a dictionary?)
The user name is in the SASL protocol messages. Postfix does not
implement the SASL protocol, it just passes the bits to Cyrus SASL
or Dovecot Auth.
Perhaps you can configure Cyrus SASL or Dovecot Auth to log it.
Wietse
