[Dovecot] Attacking Dovecot

[Nikos Papadopoulos]

Hello,

 

I am using Dovecot ver.1.0.7 on an x86 server with RedHat Linux Enterprise 5
and the following configuration:

 

# 1.0.7: /etc/dovecot.conf

protocols: pop3

login_dir: /var/run/dovecot/login

login_executable: /usr/libexec/dovecot/pop3-login

mail_location: mbox:~/mail:INBOX=/var/mail/%u

mail_executable: /usr/libexec/dovecot/pop3

mail_plugin_dir: /usr/lib/dovecot/pop3

pop3_client_workarounds: outlook-no-nuls oe-ns-eoh

auth default:

  passdb:

    driver: pam

  userdb:

    driver: passwd

 

 

It seems that my mail server is being attacked by someone who tries to
retrieve users' credentials. Please read below an output of logwatch.

 

dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information
about

user sandra

 dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information
about

user tanya

 dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information
about

user tanya

 dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information
about

user dark

 dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information
about

user dark

 dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information
about

user gibson

 dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information
about

user frank

 dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information
about

user frank

 

 

 

Besides, some of the local users receive "spam" emails, which seem to be
sent by another local user.

 

Please assist me on how to prevent the aforementioned attack.

 

Best Regards,

 

Nikos