Your logs are full of sequences containing:
- connect from
- SASL authentication failure
- lost connection after AUTH from
- disconnect from.
These are incoming connections. Every mail server gets for example this kind of brute force login attempts at some point. That's not the only thing you'll see in your logs. Just make sure you have suitable Postfix SMTP relay and access control to handle everything bad the Internet has to offer for SMTP servers. The most important thing is to avoid configuring your mail server as an open relay, which would cause malicious outbound connections, too.
For this specific issue, you could use Fail2Ban to temporarily ban such IP address. There are plenty of tutorials, but maxretry = 3
used in this one can easily cause real users to be banned, too. I'd recommend:
[postfix]
enabled = true
port = smtp,ssmtp
filter = postfix
logpath = /var/log/mail.log
maxretry = 7
At least in Debian, postfix-sasl.conf
has predefined failregex
for these authentication failures.