new signature: postfix smtp auth

[till busch]

i recently get frequent authentication failures in postfix that look like this:

Dec 17 22:34:29 host postfix/smtpd[110112]: connect from remote.host.com[93.184.216.34]
Dec 17 22:34:30 host postfix/smtpd[110112]: lost connection after AUTH from remote.host.com[93.184.216.34]
Dec 17 22:34:30 host postfix/smtpd[110112]: disconnect from remote.host.com[93.184.216.34] ehlo=1 auth=0/1 commands=1/2

i think the string “lost connection after AUTH from host[ip]” is a good marker.

for ipv6 (with unknown hostname) it looks like this:

lost connection after CONNECT from unknown[2606:2800:220:1:248:1893:25c8:1946]

‌