I need help locating the origin IP from this error messages/ login attempts:
From the 'sasl auth daemon' via Logwatch:
pam_unix(smtp:auth): check pass; user unknown pam_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= pam_succeed_if(smtp:auth): error retrieving information about user whatEver
Mar 8 04:38:51 mySuperServer saslauthd: do_auth : auth failure: [user= whatEver] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]
I know it's
saslauthd related. They try to connect to the SMTP port to send email but they are rejected. I can't seem to find the IP address anywhere; I want to block it.