5 Jun
2012
5 Jun
'12
5:45 a.m.
Glenn English writes:
I'm getting a lot of what I think is a local socket asking dovecot:auth to verify username/passwords:
May 31 09:00:54 server dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=
If dovecot-auth is getting input from a local socket, then rhost information is irrelevant since the host doing the asking is the server itself (maybe from another daemon connected to a remote host).
Maybe someone is brute forcing your server's Postfix authenticated SMTP service since Postfix can be configured to use Dovecot's SASL authentication framework.
Joseph Tam jtam.home@gmail.com