On 27 Jan 2020, at 06:42, Bill Cole <postfixlists-070...@billmail.scconsult.com> wrote: > It means that they attempted authentication 1 time but failed. > >> Sometimes I see auth=0/2 or auth=0/3. > > Which means they tried 2 or 3 times.
Hmm. I see blocks like these throughout my logs: Jan 27 11:40:25 mail postfix/submit/smtpd[62764]: connect from unknown[77.105.44.25] Jan 27 11:40:25 mail postfix/submit/smtpd[62764]: lost connection after EHLO from unknown[77.105.44.25] Jan 27 11:40:25 mail postfix/submit/smtpd[62764]: disconnect from unknown[77.105.44.25] ehlo=1 auth=0/1 commands=1/2 Jan 27 11:40:28 mail postfix/submit/smtpd[62764]: connect from unknown[77.105.44.25] Jan 27 11:40:29 mail postfix/submit/smtpd[62764]: lost connection after EHLO from unknown[77.105.44.25] Jan 27 11:40:29 mail postfix/submit/smtpd[62764]: disconnect from unknown[77.105.44.25] ehlo=1 auth=0/1 commands=1/2 Etc. repeated many times. The only other lines related to these connection are, nearly universally: Jan 27 11:46:19 mail postfix/anvil[54251]: statistics: max connection count 3 for (submission:77.105.44.25) at Jan 27 11:40:25 Jan 27 11:40:25 mail postfix/submit/smtpd[62764]: warning: hostname 77-105-44-25.adsl-2.sezampro.rs does not resolve to address 77.105.44.25: hostname nor servname provided, or not known Jan 27 11:40:25 mail postfix/submit/smtpd[62764]: warning: hostname 77-105-44-25.adsl-2.sezampro.rs does not resolve to address 77.105.44.25: hostname nor servname provided, or not known But the auth count never increases. (Postfix/submit the syslog_name set for the submission port in master.cf) -- THE PRESIDENT DID IT IS NOT AN EXCUSE Bart chalkboard Ep. AABF05
