I am using postfix with dovecot and virtual users on a centos 6 system.
I had a rush of spam recently, with tons of packs of 50 recipients delivered from an unknown account.
The current logging (maillog) does not display anything about SMTP authorizing process (restriction on SMTP is authorized users only)
All I have is the "entry point":
Oct 30 05:00:53 xxxxxxx postfix/qmgr: 7157E115443B: firstname.lastname@example.org, size=1463, nrcpt=50 (queue active)
then 50 of the following:
Oct 30 05:12:50 xxxxxxx postfix/qmgr: 7157E115443B: email@example.com, relay=none, delay=19695
I tried adding -v to the master.cf line:
smtp inet n - n - - smtpd -v
and it works - but it displays too much debugging info
How can I have only one entry in the maillog such as this:
Oct 30 06:20:21 server postfix/smtpd: xsasl_dovecot_handle_reply: auth reply: OKfirstname.lastname@example.org
for every SMTP auth attempt? (and nothing else, no elevated logging level)