[Dovecot] Auth Fails, But Can Still Get Mail
Greetings,
I've recently upgraded from version .97 to v. 1.2. Everything seems to be working OK, but I'm wondering why I'm getting authentication failure messages in /var/log/maillog. Like this:
Dec 15 11:02:41 triata dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<mycenay>, method=PLAIN, rip=140.9.5.1, lip=140.9.5.1, secured
Although that user can log in to the server and get email no problem.
Config file follows:
# 1.2.8: /etc/dovecot.conf # OS: Linux 2.6.18-92.1.6.el5.centos.plusxen x86_64 CentOS release 5 (Final) ext3 ssl_cert_file: /etc/ssl/triata.globalchangemultimedia.net/mailserver/smtpd.pem ssl_key_file: /etc/ssl/triata.globalchangemultimedia.net/mailserver/smtpd.pem login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_location: maildir:/vmail/%d/%n mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib64/dovecot/imap mail_plugin_dir(imap): /usr/lib64/dovecot/imap mail_plugin_dir(pop3): /usr/lib64/dovecot/pop3 namespace: type: private separator: / inbox: yes list: yes subscriptions: yes namespace: type: public separator: / prefix: public/ location: maildir:/vmail/public list: yes lda: postmaster_address: postmaster@globalchangemultimedia.net hostname: triata.globalchangemultimedia.net mail_plugins: sieved mail_plugin_dir: /usr/lib64/dovecot/lda auth default: mechanisms: plain login passdb: driver: pam passdb: driver: sql args: /etc/dovecot-mysql.conf userdb: driver: passwd userdb: driver: sql args: /etc/dovecot-mysql.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 432 user: vmail group: vmail
-- --asai
On Tue, 2009-12-15 at 11:53 -0700, Asai wrote:
I've recently upgraded from version .97 to v. 1.2. Everything seems to be working OK, but I'm wondering why I'm getting authentication failure messages in /var/log/maillog. Like this:
Dec 15 11:02:41 triata dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<mycenay>, method=PLAIN, rip=140.9.5.1, lip=140.9.5.1, secured
Although that user can log in to the server and get email no problem.
Maybe the user has multiple clients, or multiple accounts in one client and one of them doesn't work? Anyway seems like a user/client problem.
Timo Sirainen wrote:
On Tue, 2009-12-15 at 11:53 -0700, Asai wrote:
I've recently upgraded from version .97 to v. 1.2. Everything seems to be working OK, but I'm wondering why I'm getting authentication failure messages in /var/log/maillog. Like this:
Dec 15 11:02:41 triata dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<mycenay>, method=PLAIN, rip=140.9.5.1, lip=140.9.5.1, secured
Although that user can log in to the server and get email no problem.
Maybe the user has multiple clients, or multiple accounts in one client and one of them doesn't work? Anyway seems like a user/client problem.
Thank you for your help here.
Well, the strange thing is, I'm getting logs like this for every user I have. Some of which arent even on-line at the time of the logs. The rid is the same as the lid which is weird as it's on the same server as dovecot. I have SquirrelMail installed on this server as well. Could that be the source of this?
-- --asai
On Tue, 2009-12-15 at 12:53 -0700, Asai wrote:
Well, the strange thing is, I'm getting logs like this for every user I have. Some of which arent even on-line at the time of the logs. The rid is the same as the lid which is weird as it's on the same server as dovecot.
So the connections are coming from localhost.
I have SquirrelMail installed on this server as well. Could that be the source of this?
I guess. Or something else running on localhost trying to log in as other users?
On Tue, 2009-12-15 at 13:03 -0700, Asai wrote:
I guess. Or something else running on localhost trying to log in as other users?
What method would I use to debug this? Does Dovecot have a debug console?
Does Squirrelmail log when it attempts to authenticate a user? That would be the easiest way. The other possibility that I can think of would be to catch the process in netstat -pn output, but running that at the correct time could be a bit difficult. Or I suppose you could just make a script that runs it every second and saves the output and current time and ps output. Then when you see a log failure, look up the correct netstat output and see which process has a connection to Dovecot.
OK, thank you, Timo.
Timo Sirainen wrote:
On Tue, 2009-12-15 at 13:03 -0700, Asai wrote:
I guess. Or something else running on localhost trying to log in as other users?
What method would I use to debug this? Does Dovecot have a debug console?
Does Squirrelmail log when it attempts to authenticate a user? That would be the easiest way. The other possibility that I can think of would be to catch the process in netstat -pn output, but running that at the correct time could be a bit difficult. Or I suppose you could just make a script that runs it every second and saves the output and current time and ps output. Then when you see a log failure, look up the correct netstat output and see which process has a connection to Dovecot.
-- --asai
participants (2)
-
Asai
-
Timo Sirainen