On 27 Jan 2020, at 12:42, Bill Cole
wrote:
> Right, because they are only trying to authenticate once per connection and
> dropping the connection. If they had tried to authenticate 2 times on the
> same connection, there would be one 'disconnect from' line with 'auth=0/2’
Ah, that does make
mail postfix/submit/smtpd[62764]: connect from
unknown[77.105.44.25]
Jan 27 11:40:25 mail postfix/submit/smtpd[62764]: lost connection
after EHLO from unknown[77.105.44.25]
Jan 27 11:40:25 mail postfix/submit/smtpd[62764]: disconnect from
unknown[77.105.44.25] ehlo=1 auth=0/1 commands=1/2
Jan 27
submit/smtpd[62764]: connect from
unknown[77.105.44.25]
Jan 27 11:40:25 mail postfix/submit/smtpd[62764]: lost connection after EHLO
from unknown[77.105.44.25]
Jan 27 11:40:25 mail postfix/submit/smtpd[62764]: disconnect from
unknown[77.105.44.25] ehlo=1 auth=0/1 commands=1/2
Jan 27 11:40:28 mail po
On 27 Jan 2020, at 8:08, Dominic Raferd wrote:
On Mon, 27 Jan 2020 at 12:36, Helmut Ritter wrote:
Jan 27 13:02:37 h2786452 postfix-out/smtpd[8469]: disconnect from
unknown[193.56.28.30] ehlo=1 auth=0/1 quit=1 commands=2/3
Before I block with fail2ban, does auth=0/1 ALWAYS mean that s/o
On Mon, 27 Jan 2020 at 12:36, Helmut Ritter wrote:
> Jan 27 13:02:37 h2786452 postfix-out/smtpd[8469]: disconnect from
> unknown[193.56.28.30] ehlo=1 auth=0/1 quit=1 commands=2/3
>
> Before I block with fail2ban, does auth=0/1 ALWAYS mean that s/o tried
> to use smtp without authe
Hi,
Jan 27 13:02:37 h2786452 postfix-out/smtpd[8469]: disconnect from
unknown[193.56.28.30] ehlo=1 auth=0/1 quit=1 commands=2/3
Jan 27 13:02:58 h2786452 postfix-out/smtpd[8469]: disconnect from
unknown[193.56.28.30] ehlo=1 auth=0/1 quit=1 commands=2/3
Jan 27 13:03:24 h2786452 postfix-out/smtpd
