View Single Post
  #83  
Old 20th January 2012, 19:22
cbj4074 cbj4074 is offline
Senior Member
 
Join Date: Nov 2010
Posts: 386
Thanks: 28
Thanked 58 Times in 50 Posts
Default

This bit is a good sign; it indicates that Dovecot was configured correctly (and explains the warning you received and that I pointed-out earlier):

Code:
Jan 20 13:26:31 25612-21212 groupadd[9365]: group added to /etc/group: name=dovecot, GID=120
Jan 20 13:26:31 25612-21212 groupadd[9365]: group added to /etc/gshadow: name=dovecot
Jan 20 13:26:31 25612-21212 groupadd[9365]: new group: name=dovecot, GID=120
Jan 20 13:26:31 25612-21212 useradd[9369]: new user: name=dovecot, UID=115, GID=120, home=/usr/lib/dovecot, shell=/bin/false
Jan 20 13:26:31 25612-21212 usermod[9374]: change user 'dovecot' password
Jan 20 13:26:31 25612-21212 chage[9379]: changed password expiry for dovecot
Jan 20 13:26:31 25612-21212 chfn[9382]: changed user 'dovecot' information
Each failed login attempt was indeed logged:

Code:
Jan 20 13:47:10 25612-21212 dovecot-auth: pam_unix(dovecot:auth): check pass; user unknown
Jan 20 13:47:10 25612-21212 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=cbj4074@xanderit.com rhost=XXX.XXX.XXX.XXX 
Jan 20 13:47:19 25612-21212 dovecot-auth: pam_unix(dovecot:auth): check pass; user unknown
Jan 20 13:47:19 25612-21212 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=cbj4074@xanderit.com rhost=XXX.XXX.XXX.XXX
So, the message is always "check pass; user unknown", followed by "authentication failure".

Unfortunately, that on its own doesn't tell us much.

There should be corresponding log entries in /var/log/mail.log. See if you can find any entry that corresponds to the above (use the timestamp).

I expect you to find something like this:

Code:
Jan 20 10:07:19 hostname dovecot: imap-login: Disconnected (auth failed, 3 attempts): user=<cbj4074@xanderit.com>, method=PLAIN, rip=XXX.XXX.XXX.XXX, lip=XXX.XXX.XXX.XXX, TLS
We're making progress. At least now the logs are reflecting what is actually happening.

It seems that there may be a disconnect between ISPConfig's virtual mailbox DB tables and the authentication mechanism that Dovecot is attempting to use.

I also want to point-out that I don't have these messages in /var/log/auth.log:

Code:
Jan 20 12:35:01 25612-21212 postfix/smtpd[5188]: sql auxprop plugin using mysql engine
You have this message in your log quite frequently. It is probably safe to assume that this message is related or in addition to the IMAP/POP issue.

Can you please post the full contents of /etc/postfix/main.cf and /etc/postfix/master.cf?

It would be worth having a look at the Dovecot configuration, too, so please post /etc/dovecot/dovecot.conf.
Reply With Quote