15 Mar
2005
15 Mar
'05
11:15 p.m.
On Sun, 2005-03-13 at 15:48 -0600, F. Even wrote:
I'm curious about exactly what this means in my log:
Mar 13 10:56:20 cerebus dovecot: imap-login: Disconnected [130.94.242.20] Mar 13 10:56:51 cerebus last message repeated 177 times Mar 13 10:57:32 cerebus last message repeated 179 times
Now...does Dovecot ONLY log the names of users on successful attempts?
By default, yes.
Is this "Disconnected" log entry an indication someone ran a username/password attack against the imap server and failed to authenticate? If so, is there any way to make this a little more verbose, so I can perhaps see what names, etc. the annoying idiot is throwing against my server....?
auth_verbose = yes