Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

First let me state that the mail server is working fine and users can connect and send email.

Basically there is a local web script connecting into the mail server trying to send mail every few minutes. It has the wrong password. Problem is we don't know what script is connecting in so we are looking for a way to get the username which is being tried.

UGFzc3dvcmQ6 - decodes to Password: so isn't much help. A full log line is below.

Dec 11 20:15:37 HOST postfix/smtpd[642]: warning: HOST[x.x.x.x]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Server is running Debian/Postfix/Dovecot.

share|improve this question
up vote 7 down vote accepted

We were able to trace the username by using Dovecot itself.

In the /etc/dovecot/conf.d/10-logging.conf config we enabled verbose auth logging using

auth_verbose = yes

This put the information in

share|improve this answer
Shouldn't the log be in /var/log/dovecot-info.log? – Chloe May 8 at 23:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.