I need help locating the origin IP from this error messages/ login attempts:
From the 'sasl auth daemon' via Logwatch:
pam_unix(smtp:auth): check pass; user unknown
pam_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
pam_succeed_if(smtp:auth): error retrieving information about user whatEver
From /var/log/messages
:
Mar 8 04:38:51 mySuperServer saslauthd[17397]: do_auth : auth failure: [user= whatEver] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]
I know it's saslauthd
related. They try to connect to the SMTP port to send email but they are rejected. I can't seem to find the IP address anywhere; I want to block it.