Hello,

I am using dovecot_authenticator for Exim and I get a lot of authentication failure log entries, most of them due to brute force attacks. The log entries are like this:

2021-10-11 13:30:21 dovecot_login authenticator failed for ([5.188.206.194]) [5.188.206.194]: 535 Incorrect authentication data

I wonder whether it would be possible to show the user ID the attacker used to authenticate himself.

Here it is the SMTP data for one of these SMTP sessions:

SMTP>> 250-disguised.domain.com Hello [5.188.206.194] [5.188.206.194]
SMTP<< AUTH LOGIN
SMTP>> 334 VXNlcm5hbWU6
received: CONT  1       UGFzc3dvcmQ6
SMTP>> 334 UGFzc3dvcmQ6
received: FAIL  1       user=webmaster@somedomain.net
SMTP>> 535 Incorrect authentication data
LOG: MAIN REJECT
  dovecot_login authenticator failed for ([5.188.206.194]) [5.188.206.194]: 535 Incorrect authentication data
SMTP>> 421 disguised.domain.com lost input connection

Warm regards,

Jesús Ángel.