[Dovecot] Authentication Error Message formats

[Albert E. Whale]

Charles Marcus wrote:
> On 10/29/2008, Albert E. Whale (aewhale at ABS-CompTech.com) wrote:
>   
>> When a user fails authentication, or a user does not exist, it appears
>> that the same message is used for these events.
>>     
>
> When asking for help, it is always a good idea to provide some basic
> info... in  this case, sample log entries from failed events, and output
> of dovecot -n?
>
>   
Thank Charles, my apologies.

Here is the Logging info:

Oct 29 09:43:12 192.168.50.5 dovecot: pop3-login: Aborted login (auth
failed, 1 attempts): user=<darrel>, method=PLAIN, rip=217.168.145.51,
lip=66.207.133.234
Oct 29 09:43:15 192.168.50.5 dovecot: auth-worker(default):
pam(darrel,217.168.145.51): pam_authenticate() failed: Authentication
failure
Oct 29 09:43:17 192.168.50.5 dovecot: pop3-login: Aborted login (auth
failed, 1 attempts): user=<darrel>, method=PLAIN, rip=217.168.145.51,
lip=66.207.133.234
Oct 29 09:43:20 192.168.50.5 dovecot: auth-worker(default):
pam(darrel,217.168.145.51): pam_authenticate() failed: Authentication
failure
Oct 29 09:43:22 192.168.50.5 dovecot: pop3-login: Aborted login (auth
failed, 1 attempts): user=<darrel>, method=PLAIN, rip=217.168.145.51,
lip=66.207.133.234

And my dovecot.conf is attached.

BTW, these entries are samples of invalid users.

-- 
Albert E. Whale, CHS CISA CISSP
Sr. Security, Network, Risk Assessment and Systems Consultant
------------------------------------------------------------------------
ABS Computer Technology, Inc. <http://www.ABS-CompTech.com> - Email,
Internet and Security Consultants
SPAMZapper <http://www.Spam-Zapper.com> - No-JunkMail.com
<http://www.No-JunkMail.com> - *True Spam Elimination*.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: dovecot.conf-102708.txt
Url: http://dovecot.org/pipermail/dovecot/attachments/20081029/68e588d0/attachment-0001.txt