Where can I found the log that dovecot writes if a user fails to log in? I am authenticating agains an sql db, but I can't find where dovecot logs this, if it does?
Regards,
BTJ
--
Bjørn T Johansen
btj@havleik.no
Someone wrote: "I understand that if you play a Windows CD backwards you hear strange Satanic messages" To which someone replied: "It's even worse than that; play it forwards and it installs Windows"
On Dec 20, 2007 2:01 PM, Bjørn T Johansen btj@havleik.no wrote:
Where can I found the log that dovecot writes if a user fails to log in? I am authenticating agains an sql db, but I can't find where dovecot logs this, if it does?
Regards,
BTJ
--
Bjørn T Johansen
btj@havleik.no
Someone wrote: "I understand that if you play a Windows CD backwards you hear strange Satanic messages" To which someone replied: "It's even worse than that; play it forwards and it installs Windows"
http://wiki.dovecot.org/Debugging/Authentication?highlight=%28debug%29
Marius
On Thu, 20 Dec 2007 14:07:43 +0200 "Marius ROMAN" marius.roman@gmail.com wrote:
On Dec 20, 2007 2:01 PM, Bjørn T Johansen btj@havleik.no wrote:
Where can I found the log that dovecot writes if a user fails to log in? I am authenticating agains an sql db, but I can't find where dovecot logs this, if it does?
Regards,
BTJ
http://wiki.dovecot.org/Debugging/Authentication?highlight=%28debug%29
Marius
Yes, I know about those but I was kind of hoping to see failed authentications in some logs without enabling debug logging, like if I use PAM authentication....
BTJ
On Thu, 20 Dec 2007 18:42:01 +0200 Timo Sirainen tss@iki.fi wrote:
On Thu, 2007-12-20 at 13:18 +0100, Bjørn T Johansen wrote:
Yes, I know about those but I was kind of hoping to see failed authentications in some logs without enabling debug logging, like if I use PAM authentication....
auth_verbose=yes enables logging failed logins.
That did the trick... thx... :)
If I only had learned regexp like I have been meaning too for many years now, this would have been a piece of cake but...
Does anyone use Dovecot together with fail2ban? If so, could any one share the failregex they are using? (A) (or perhaps someone could create a regexp that recognize a line like this:
dovecot: Dec 21 11:58:07 Info: auth(default): sql(btj@havleik.no,85.19.143.23): Password mismatch
)
BTJ
I use pam authentication in dovecot and the following fail2ban filter seems to work fine for me:
failregex = auth\(default\): pam\(.*,<HOST>\): pam_authenticate\(\) failed:
Rob
On Fri, 2007-12-21 at 12:04 +0100, Bjørn T Johansen wrote:
On Thu, 20 Dec 2007 18:42:01 +0200 Timo Sirainen tss@iki.fi wrote:
On Thu, 2007-12-20 at 13:18 +0100, Bjørn T Johansen wrote:
Yes, I know about those but I was kind of hoping to see failed authentications in some logs without enabling debug logging, like if I use PAM authentication....
auth_verbose=yes enables logging failed logins.
That did the trick... thx... :)
If I only had learned regexp like I have been meaning too for many years now, this would have been a piece of cake but...
Does anyone use Dovecot together with fail2ban? If so, could any one share the failregex they are using? (A) (or perhaps someone could create a regexp that recognize a line like this:
dovecot: Dec 21 11:58:07 Info: auth(default): sql(btj@havleik.no,85.19.143.23): Password mismatch
)
BTJ
Please consider the environment before printing this email.
GAME Stores Group Ltd has been awarded �Retailer of the Year� at the 2006 Golden Joystick Awards and 'Thames Valley Business Award' for Outstanding Employer of Choice 2006.
This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the system manager at:
mailto:postmaster@game.co.ukThe recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore THE GAME GROUP PLC and any of its subsidiaries do not give any warranty as to the quality or accuracy of any information contained in the message or assume any liability for it or for its transmission, reception or storage.
This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of computer viruses.
http://www.game.co.uk http://www.gamegroup.plc.uk
Registered Number: 1937170 Registered Office: Unity House, Telford Road, Basingstoke, Hampshire. RG21 6YJ Registered in England and Wales.
Yes, but that doesn't work for sql auth; as you see, the line logged is different...
BTJ
On Fri, 21 Dec 2007 14:32:01 +0000 Rob Coward rob.coward@game.co.uk wrote:
I use pam authentication in dovecot and the following fail2ban filter seems to work fine for me:
failregex = auth\(default\): pam\(.*,<HOST>\): pam_authenticate\(\) failed:
Rob
On Fri, 2007-12-21 at 12:04 +0100, Bj__rn T Johansen wrote:
On Thu, 20 Dec 2007 18:42:01 +0200 Timo Sirainen tss@iki.fi wrote:
On Thu, 2007-12-20 at 13:18 +0100, Bj__rn T Johansen wrote:
Yes, I know about those but I was kind of hoping to see failed authentications in some logs without enabling debug logging, like if I use PAM authentication....
auth_verbose=yes enables logging failed logins.
That did the trick... thx... :)
If I only had learned regexp like I have been meaning too for many years now, this would have been a piece of cake but...
Does anyone use Dovecot together with fail2ban? If so, could any one share the failregex they are using? (A) (or perhaps someone could create a regexp that recognize a line like this:
dovecot: Dec 21 11:58:07 Info: auth(default): sql(btj@havleik.no,85.19.143.23): Password mismatch
)
BTJ
Please consider the environment before printing this email.
GAME Stores Group Ltd has been awarded _Retailer of the Year_ at the 2006 Golden Joystick Awards and 'Thames Valley Business Award' for Outstanding Employer of Choice 2006.
This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the system manager at:
mailto:postmaster@game.co.ukThe recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore THE GAME GROUP PLC and any of its subsidiaries do not give any warranty as to the quality or accuracy of any information contained in the message or assume any liability for it or for its transmission, reception or storage.
This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of computer viruses. http://www.game.co.uk http://www.gamegroup.plc.uk
Registered Number: 1937170 Registered Office: Unity House, Telford Road, Basingstoke, Hampshire. RG21 6YJ Registered in England and Wales.
Yes, but surely its not a big leap for you to rewrite my regex to:
auth\(default\): sql\(.*,<HOST>\): Password mismatch
Rob
On Fri, 2007-12-21 at 16:30 +0100, Bjørn T Johansen wrote:
Yes, but that doesn't work for sql auth; as you see, the line logged is different...
BTJ
On Fri, 21 Dec 2007 14:32:01 +0000 Rob Coward rob.coward@game.co.uk wrote:
I use pam authentication in dovecot and the following fail2ban filter seems to work fine for me:
failregex = auth\(default\): pam\(.*,<HOST>\): pam_authenticate\(\) failed:
Rob
On Fri, 2007-12-21 at 12:04 +0100, Bj__rn T Johansen wrote:
On Thu, 20 Dec 2007 18:42:01 +0200 Timo Sirainen tss@iki.fi wrote:
On Thu, 2007-12-20 at 13:18 +0100, Bj__rn T Johansen wrote:
Yes, I know about those but I was kind of hoping to see failed authentications in some logs without enabling debug logging, like if I use PAM authentication....
auth_verbose=yes enables logging failed logins.
That did the trick... thx... :)
If I only had learned regexp like I have been meaning too for many years now, this would have been a piece of cake but...
Does anyone use Dovecot together with fail2ban? If so, could any one share the failregex they are using? (A) (or perhaps someone could create a regexp that recognize a line like this:
dovecot: Dec 21 11:58:07 Info: auth(default): sql(btj@havleik.no,85.19.143.23): Password mismatch
)
BTJ
Please consider the environment before printing this email.
GAME Stores Group Ltd has been awarded _Retailer of the Year_ at the 2006 Golden Joystick Awards and 'Thames Valley Business Award' for Outstanding Employer of Choice 2006.
This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the system manager at:
mailto:postmaster@game.co.ukThe recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore THE GAME GROUP PLC and any of its subsidiaries do not give any warranty as to the quality or accuracy of any information contained in the message or assume any liability for it or for its transmission, reception or storage.
This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of computer viruses. http://www.game.co.uk http://www.gamegroup.plc.uk
Registered Number: 1937170 Registered Office: Unity House, Telford Road, Basingstoke, Hampshire. RG21 6YJ Registered in England and Wales.
Please consider the environment before printing this email.
GAME Stores Group Ltd has been awarded �Retailer of the Year� at the 2006 Golden Joystick Awards and 'Thames Valley Business Award' for Outstanding Employer of Choice 2006.
This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the system manager at:
mailto:postmaster@game.co.ukThe recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore THE GAME GROUP PLC and any of its subsidiaries do not give any warranty as to the quality or accuracy of any information contained in the message or assume any liability for it or for its transmission, reception or storage.
This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of computer viruses.
http://www.game.co.uk http://www.gamegroup.plc.uk
Registered Number: 1937170 Registered Office: Unity House, Telford Road, Basingstoke, Hampshire. RG21 6YJ Registered in England and Wales.
If you know regexp so... But thx... :)
BTJ
On Fri, 21 Dec 2007 15:40:09 +0000 Rob Coward rob.coward@game.co.uk wrote:
Yes, but surely its not a big leap for you to rewrite my regex to:
auth\(default\): sql\(.*,<HOST>\): Password mismatch
Rob
On Fri, 2007-12-21 at 16:30 +0100, Bjørn T Johansen wrote:
Yes, but that doesn't work for sql auth; as you see, the line logged is different...
BTJ
On Fri, 21 Dec 2007 14:32:01 +0000 Rob Coward rob.coward@game.co.uk wrote:
I use pam authentication in dovecot and the following fail2ban filter seems to work fine for me:
failregex = auth\(default\): pam\(.*,<HOST>\): pam_authenticate\(\) failed:
Rob
On Fri, 2007-12-21 at 12:04 +0100, Bj__rn T Johansen wrote:
On Thu, 20 Dec 2007 18:42:01 +0200 Timo Sirainen tss@iki.fi wrote:
On Thu, 2007-12-20 at 13:18 +0100, Bj__rn T Johansen wrote:
Yes, I know about those but I was kind of hoping to see failed authentications in some logs without enabling debug logging, like if I use PAM authentication....
auth_verbose=yes enables logging failed logins.
That did the trick... thx... :)
If I only had learned regexp like I have been meaning too for many years now, this would have been a piece of cake but...
Does anyone use Dovecot together with fail2ban? If so, could any one share the failregex they are using? (A) (or perhaps someone could create a regexp that recognize a line like this:
dovecot: Dec 21 11:58:07 Info: auth(default): sql(btj@havleik.no,85.19.143.23): Password mismatch
)
BTJ
Please consider the environment before printing this email.
GAME Stores Group Ltd has been awarded _Retailer of the Year_ at the 2006 Golden Joystick Awards and 'Thames Valley Business Award' for Outstanding Employer of Choice 2006.
This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the system manager at:
mailto:postmaster@game.co.ukThe recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore THE GAME GROUP PLC and any of its subsidiaries do not give any warranty as to the quality or accuracy of any information contained in the message or assume any liability for it or for its transmission, reception or storage.
This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of computer viruses. http://www.game.co.uk http://www.gamegroup.plc.uk
Registered Number: 1937170 Registered Office: Unity House, Telford Road, Basingstoke, Hampshire. RG21 6YJ Registered in England and Wales.
Please consider the environment before printing this email.
GAME Stores Group Ltd has been awarded Retailer of the Year at the 2006 Golden Joystick Awards and 'Thames Valley Business Award' for Outstanding Employer of Choice 2006.
This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the system manager at:
mailto:postmaster@game.co.ukThe recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore THE GAME GROUP PLC and any of its subsidiaries do not give any warranty as to the quality or accuracy of any information contained in the message or assume any liability for it or for its transmission, reception or storage.
This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of computer viruses.
http://www.game.co.uk http://www.gamegroup.plc.uk
Registered Number: 1937170 Registered Office: Unity House, Telford Road, Basingstoke, Hampshire. RG21 6YJ Registered in England and Wales.
- Bjørn T Johansen, 2007-12-25 12:36
On Fri, 21 Dec 2007 15:40:09 +0000 Rob Coward rob.coward@game.co.uk wrote:
Yes, but surely its not a big leap for you to rewrite my regex to:
auth\(default\): sql\(.*,<HOST>\): Password mismatch
Rob
If you know regexp so... But thx... :)
BTJ
SCNR, Thomas
=-------------------------------------------------------------------------=
- Thomas "ZlatkO" Zajic zlatko@gmx.at Linux-2.6.23 & Thunderbird-2.0 -
"It is not easy to cut through a human head with a hacksaw." (M. C.) -
participants (5)
-
Bjørn T Johansen
-
Marius ROMAN
-
Rob Coward
-
Thomas Zajic
-
Timo Sirainen