localhost logins

[Daniel Miller]

On 6/27/2017 12:42 AM, Fabian Schmidt wrote:
>
> Am 26.06.17 schrieb Daniel Miller:
>
>> On 2017-06-23 15:09, Marcus Rueckert wrote:
>>> On Fri, 23 Jun 2017 11:38:28 -0700
>>> Daniel Miller <dmiller at amfes.com> wrote:
>>>
>>>> While auditing my logs after an account was compromised, I see a
>>>> number of entries like:
>>>>
>>>> Jun 23 11:32:18 bubba dovecot: auth:
>>>> ldap("one-of-my-accounts",127.0.0.1): invalid credentials
>>>
>>> webmail?
>
> Nagios or someone else monitoring dovecot?
>
Not running such - and they wouldn't be hitting multiple accounts.

Daniel