On 6/19/2023 10:52 PM, Shawn Heisey wrote:
Interesting. In the 2.3.20 tag, I found the code that prints that
message in src/login-common/client-common.c ... but that same code is
not present in the main branch. It looks to me like that code has been
completely overhauled and maybe 2.4 won't have this problem when it gets
released.
Hmm. Maybe I am wrong. I grepped my log for inactivity disconnects
that do not say "auth failed". All of the things it found were for my
email address, and had a timeout of 1800 seconds, not 180 seconds like
the ones for the other user that say "auth failed."
elyograg@bilbo:~$ sudo grep Inactivity /var/log/mail.log | grep -v "auth
failed"
Jun 18 04:20:18 bilbo dovecot:
imap(elyograg@elyograg.org)<412591>: Disconnected:
Inactivity - no input for 1800 secs in=38963 out=457431 deleted=0
expunged=0 trashed=0 hdr_count=1 hdr_bytes=230 body_count=1 body_bytes=10647
Jun 18 04:24:28 bilbo dovecot:
imap(elyograg@elyograg.org)<340404>: Disconnected:
Inactivity - no input for 1800 secs in=69198 out=823917 deleted=0
expunged=0 trashed=0 hdr_count=3 hdr_bytes=2163 body_count=3
body_bytes=47071
Jun 18 22:42:04 bilbo dovecot:
imap(elyograg@elyograg.org)<701301>: Disconnected:
Inactivity - no input for 1801 secs in=4726 out=13697 deleted=0
expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Jun 19 03:18:37 bilbo dovecot:
imap(elyograg@elyograg.org)<579102>: Disconnected:
Inactivity - no input for 1800 secs in=8330 out=102365 deleted=0
expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Jun 19 08:58:05 bilbo dovecot:
imap(elyograg@elyograg.org)<773980>: Disconnected:
Inactivity - no input for 1800 secs in=4710 out=13725 deleted=0
expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Jun 19 18:05:50 bilbo dovecot:
imap(elyograg@elyograg.org)<841537>: Disconnected:
Inactivity - no input for 1800 secs in=174 out=4799 deleted=0 expunged=0
trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Jun 19 19:29:21 bilbo dovecot:
imap(elyograg@elyograg.org)<577941>: Disconnected:
Inactivity - no input for 1801 secs in=28256 out=331141 deleted=0
expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
So maybe the other user with the auth failed messages was actually
failing auth. Today they actually got banned by fail2ban because they
had a ton of the "auth failed" logs in quick succession. I re-iterated
the correct IMAP server settings and there hasn't been a repeat of that
log message since that time. Maybe they had actually typed in the
password wrong.
Apologies for the noise!
Thanks,
Shawn