Friday, July 8, 2011, 4:54:19 AM, babajaga wrote:

I am receiving a lot of error messages dovecot-auth: gkr-pam: error looking up user information for: <user>

Unfortunately, I do not see the IP of the remote client, trying to break in. Is there any possibility to get it ? Would be useful to block the IP.

You didn't state the version of Dovecot you were running. Here I have Dovecot 2.0.12.

I have set in the config:

auth_verbose = yes auth_verbose_passwords = sha1

It logs the sha1 hash of the password attempt. I also have a cron set up to email me the password attempts from the previous day:

# Check for email accounts that have login attempts with # incorrect passwords from the previous day. 0 3 * * * /usr/bin/bzegrep -i 'password.mismatch' /var/log/maillog.0.bz2

From the commented config file 10-logging.conf:

# Log unsuccessful authentication attempts and the reasons why they failed. #auth_verbose = no # In case of password mismatches, log the attempted password. Valid values are # no, plain and sha1. sha1 can be useful for detecting brute force password # attempts vs. user simply trying the same password over and over again. #auth_verbose_passwords = no

-- Best regards, Duane mailto:duane@duanemail.org