----- Message from Timo Sirainen <tss@iki.fi> --------- Date: Mon, 5 Dec 2011 23:24:23 +0200 From: Timo Sirainen <tss@iki.fi> Reply-To: Dovecot Mailing List <dovecot@dovecot.org> Subject: Re: [Dovecot] MS Exchange IMAP Proxy (Logging Auth Failures?) To: Terry Carmen <terry@cnysupport.com> Cc: dovecot@dovecot.org
On 5.12.2011, at 23.05, Terry Carmen wrote:
The log looks like this: ..
All of the lines are "debug" level. Find the "info" log. "doveadm
log find" usually finds it for you.
[root@server conf.d]# doveadm log find Looking for log files from /var/log Debug: /var/log/maillog Info: /var/log/maillog Warning: /var/log/maillog Error: /var/log/maillog Fatal: /var/log/maillog
The successful logins look good. For example:
Dec 5 17:01:50 it dovecot: imap-login: Login: user=<username>,
method=PLAIN, rip=123.123.123.123, lip=10.1.2.3, mpid=12277, TLS
However there's nothing similar for the failed logins:
Dec 5 17:01:36 it dovecot: auth: Debug: imapc(10.1.2.3:143):
Authenticating as username
Dec 5 17:01:36 it dovecot: auth: Debug: imapc(10.1.2.3:143): Disconnected
Dec 5 17:01:38 it dovecot: auth: Debug: client out:
FAIL#0111#011user=username
Dec 5 17:01:46 it dovecot: auth: Debug: client in:
AUTH#0112#011PLAIN#011service=imap#011secured#011lip=10.1.20.52#011rip=123.123.123.123#011lport=143#011rport=41748#011resp=<hidden>
I checked lib-imap-client/imapc-connection.c and found where the
"Authenticating as" message comes from, but don't see anyplace where the
I believe I found the section of code that does the imapc
authentication, but don't see anyplace where auth failures are logged:
Any thoughts?
Terry