<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello,</p>
<p>The problem was I forgot to add the server_set_id = $auth1 line
to the dovecot_login authenticator.</p>
<p>Regards,</p>
<p>Jesús Ángel.<br>
</p>
<div class="moz-cite-prefix">On 11/10/2021 13:35, Jesús Ángel del
Pozo wrote:<br>
</div>
<blockquote type="cite"
cite="mid:3b185a23-1340-b721-f609-70a383d7a99d@xolido.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<p>Hello,</p>
<p>I am using dovecot_authenticator for Exim and I get a lot of
authentication failure log entries, most of them due to brute
force attacks. The log entries are like this:</p>
<pre>2021-10-11 13:30:21 dovecot_login authenticator failed for ([5.188.206.194]) [5.188.206.194]: 535 Incorrect authentication data</pre>
<p>I wonder whether it would be possible to show the user ID the
attacker used to authenticate himself.</p>
<p>Here it is the SMTP data for one of these SMTP sessions:</p>
<pre>SMTP>> 250-disguised.domain.com Hello [5.188.206.194] [5.188.206.194]
SMTP<< AUTH LOGIN
SMTP>> 334 VXNlcm5hbWU6
received: CONT 1 UGFzc3dvcmQ6
SMTP>> 334 UGFzc3dvcmQ6
received: FAIL 1 <a class="moz-txt-link-abbreviated moz-txt-link-freetext" href="mailto:user=webmaster@somedomain.net" moz-do-not-send="true">user=webmaster@somedomain.net</a>
SMTP>> 535 Incorrect authentication data
LOG: MAIN REJECT
dovecot_login authenticator failed for ([5.188.206.194]) [5.188.206.194]: 535 Incorrect authentication data
SMTP>> 421 disguised.domain.com lost input connection
</pre>
<p>Warm regards,</p>
<p>Jesús Ángel.<br>
</p>
</blockquote>
</body>
</html>