Hello,
I am using Dovecot ver.1.0.7 on an x86 server with RedHat Linux Enterprise 5 and the following configuration:
# 1.0.7: /etc/dovecot.conf
protocols: pop3
login_dir: /var/run/dovecot/login
login_executable: /usr/libexec/dovecot/pop3-login
mail_location: mbox:~/mail:INBOX=/var/mail/%u
mail_executable: /usr/libexec/dovecot/pop3
mail_plugin_dir: /usr/lib/dovecot/pop3
pop3_client_workarounds: outlook-no-nuls oe-ns-eoh
auth default:
passdb:
driver: pamuserdb:
driver: passwdIt seems that my mail server is being attacked by someone who tries to retrieve users' credentials. Please read below an output of logwatch.
dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about
user sandra
dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about
user tanya
dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about
user tanya
dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about
user dark
dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about
user dark
dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about
user gibson
dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about
user frank
dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about
user frank
Besides, some of the local users receive "spam" emails, which seem to be sent by another local user.
Please assist me on how to prevent the aforementioned attack.
Best Regards,
Nikos