Fwd: Intermittent IMAP Login failures - about 25% fail

[Mobile Phone]

Yes, I had as soon as I saw strange results.
The fault is still intermittent and affecting all clients.



auth.log:
Apr  7 15:05:27 brazil auth: message repeated 10 times: [
pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0
tty=dovecot ruser=prtg.08dir rhost=91.91.91.91  user=prtg.08dir]

mail.log:
Apr  7 15:05:01 brazil dovecot: imap-login: Aborted login (auth failed, 1
attempts in 4 secs): user=<prtg.08dir>, method=PLAIN, rip=99.99.99.99,
lip=91.91.91.91, TLS, session=<sYQ7kOUvjQBex5Un>
Apr  7 15:05:02 brazil postfix/smtpd[13968]: connect from
unknown[91.91.19.91]
Apr  7 15:05:02 brazil postfix/smtpd[13968]: disconnect from
unknown[91.91.19.91]
Apr  7 15:05:27 brazil dovecot: auth: Debug: auth client connected
(pid=14880)
Apr  7 15:05:27 brazil dovecot: auth: Debug: client in:
AUTH#0111#011PLAIN#011service=imap#011secured#011session=AY8JkxUvzQBex5Un#011lip=99.99.99.99#011rip=91.91.19.91#011lport=143#011rport=59085#011resp=AHBydGcuMDhkaXJlY3QAV2VmdWNraW5IYXRlU3BhbQ==
(previous base64 data may contain sensitive data)
Apr  7 15:05:27 brazil dovecot: auth-worker(13031): Debug:
pam(prtg.08dir,91.91.19.91): lookup service=dovecot
Apr  7 15:05:27 brazil dovecot: auth-worker(13031): Debug:
pam(prtg.08dir,91.91.19.91): #1/1 style=1 msg=Password:
Apr  7 15:05:29 brazil dovecot: auth-worker(13031):
pam(prtg.08dir,91.91.19.91): pam_authenticate() failed: Authentication
failure (password mismatch?) (given password: YesThisWasTheCorrectPassword)
Apr  7 15:05:31 brazil dovecot: auth: Debug: client passdb out:
FAIL#0111#011user=prtg.08dir
Apr  7 15:05:31 brazil dovecot: imap-login: Aborted login (auth failed, 1
attempts in 4 secs): user=<prtg.08dir>, method=PLAIN, rip=91.91.19.91,
lip=99.99.99.99, TLS, session=<AY8JkuUvzQBex5Un>

syslog:
root at brazil:/var/log# cat syslog|grep "Apr  7 15:05"|more
Apr  7 15:05:01 brazil dovecot: auth: Debug: client passdb out:
FAIL#0111#011user=prtg.08dir
Apr  7 15:05:01 brazil dovecot: imap-login: Aborted login (auth failed, 1
attempts in 4 secs): user=<prtg.08dir>, method=PLAIN, rip=91.91.91.91,
lip=99.99.99.99, TLS, session=<sYQ7kOUvjQBex5Un>
Apr  7 15:05:02 brazil postfix/smtpd[13968]: connect from
unknown[91.91.91.91]
Apr  7 15:05:02 brazil postfix/smtpd[13968]: disconnect from
unknown[91.91.91.91]
Apr  7 15:05:27 brazil dovecot: auth: Debug: auth client connected
(pid=14880)
Apr  7 15:05:27 brazil dovecot: auth: Debug: client in:
AUTH#0111#011PLAIN#011service=imap#011secured#011session=AY8JkuUvzQBex5Un#011lip=99.99.99.99#011rip=91.91.91.91#011lport=143#011rport=59085#011resp=AHBydGcuMDhkaXJlY3QAV2VmdWNraW5IYXRlU3BhbQ==
(previous base64 data may contain sensitive data)
Apr  7 15:05:27 brazil dovecot: auth-worker(13031): Debug:
pam(prtg.08dir,91.91.91.91): lookup service=dovecot
Apr  7 15:05:27 brazil dovecot: auth-worker(13031): Debug:
pam(prtg.08dir,91.91.91.91): #1/1 style=1 msg=Password:
Apr  7 15:05:29 brazil dovecot: auth-worker(13031):
pam(prtg.08dir,91.91.91.91): pam_authenticate() failed: Authentication
failure (password mismatch?) (given password: YesThisWasTheCorrectPassword)
Apr  7 15:05:31 brazil dovecot: auth: Debug: client passdb out:
FAIL#0111#011user=prtg.08dir
Apr  7 15:05:31 brazil dovecot: imap-login: Aborted login (auth failed, 1
attempts in 4 secs): user=<prtg.08dir>, method=PLAIN, rip=91.91.91.91,
lip=99.99.99.99, TLS, session=<AY8JkuUvzQBex5Un>
Apr  7 15:05:33 brazil dovecot: auth: Debug: auth client connected
(pid=14881)


Why it this bouncing 25% + of IMAP AUTH LOGINs?

On 7 April 2016 at 14:02, Steffen Kaiser <skdovecot at smail.inf.fh-brs.de>
wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Thu, 7 Apr 2016, Mobile Phone wrote:
>
> New server & just added three domains:
>> now I see
>> "dovecot: imap-login: Aborted login (auth failed, 1 attempts in 5 secs):
>> user=<username.companyname>, method=PLAIN, rip=1.1.1.1, lip=99.99.99.99,
>> TLS, session=<kw6Y2NYviQBex5Un>"
>> Plus all Outlook users keep being bounced and finally get in.
>>
>
> Did you tried to enable auth debug?
>
> http://wiki2.dovecot.org/Debugging/Authentication
>
> - -- Steffen Kaiser
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQEVAwUBVwZad3z1H7kL/d9rAQLDGwf/RS54zzxS4P6XxBmwPL2b3iA2YD5a9dHL
> +jTs6s5zS0leX8PWcrjES9BoU8pRBRm4IRqJFI5eZeWmhSVvHSe5iAEZ0n8k+MGc
> yunHljQLvsNg5EJtxiOf7TLw9k7lJuilKb5WR1aC5gBO0NscxWUIhXHy1uSGOGv8
> xtzZPSvmZJcjQWqtVl7NklUy8+jRj42uwtS3Q3G2OhyBR45vpsPQBkeNsYHaITdF
> Q+LE6lAaVFuxCoX7d4XQyt+craNq0mNEl3A6DBb41YY6bK+QdXt9ciG1iOAF1aR1
> zPRlII0Vt1USX9Jw+B24/f6zfFv5yQ6q/k35o9YO0taot5swtnJBOA==
> =2aRu
> -----END PGP SIGNATURE-----
>
>