Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

First let me state that the mail server is working fine and users can connect and send email.

Basically there is a local web script connecting into the mail server trying to send mail every few minutes. It has the wrong password. Problem is we don't know what script is connecting in so we are looking for a way to get the username which is being tried.

UGFzc3dvcmQ6 - decodes to Password: so isn't much help. A full log line is below.

Dec 11 20:15:37 HOST postfix/smtpd[642]: warning: HOST[x.x.x.x]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Server is running Debian/Postfix/Dovecot.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

We were able to trace the username by using Dovecot itself.

In the config we enabled verbose auth logging using

auth_verbose = yes

This put the information in

/etc/dovecot/info.log
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.