Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > Linux Forums > Server Operation

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Reply
 
Thread Tools Display Modes
  #1  
Old 13th November 2011, 10:27
kokusoft kokusoft is offline
Junior Member
 
Join Date: Dec 2010
Posts: 10
Thanks: 0
Thanked 0 Times in 0 Posts
Default Dovecot log strange... for me :)

logwatch report a strange (for me) error which I do not understand:

--------------------- pam_unix Begin ------------------------

dovecot:
Authentication Failures:
user1@mydomain.ro rhost=127.0.0.1 : 395 Time(s)
user2@mydomain.ro rhost=192.168.100.1 : 325 Time(s)
.
.
.

it's available for all users



--------------------- Connections (secure-log) Begin ------------------------


**Unmatched Entries**
dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about user user1@mydomain.ro
dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about user user2@mydomain.ro
...

it's available for all users

The email service working well... but dovecot report this malfunction
Please help for fix this.
Thanks
Reply With Quote
Sponsored Links
  #2  
Old 15th November 2011, 12:04
kokusoft kokusoft is offline
Junior Member
 
Join Date: Dec 2010
Posts: 10
Thanks: 0
Thanked 0 Times in 0 Posts
Default

Nobody can help me? I'm a stupid guy or it's a really malfunction?
Reply With Quote
  #3  
Old 15th November 2011, 12:09
till till is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 37,015
Thanks: 840
Thanked 5,652 Times in 4,461 Posts
Default

Looks as if someone tried to authenticate to a local webmail client with a non existing email user.
__________________
Till Brehm
--
Get ISPConfig support and the ISPConfig 3 manual from ispconfig.org.
Reply With Quote
  #4  
Old 15th November 2011, 14:29
kokusoft kokusoft is offline
Junior Member
 
Join Date: Dec 2010
Posts: 10
Thanks: 0
Thanked 0 Times in 0 Posts
Default

Looks.. but they exist
Reply With Quote
  #5  
Old 15th November 2011, 17:36
xemox xemox is offline
Junior Member
 
Join Date: Nov 2011
Posts: 6
Thanks: 0
Thanked 0 Times in 0 Posts
Default

1. open 2 windows, first for `tail -f $your_dovecot.log` and second for debugging process

2. debug your mail server (pop3,pop3s,imap,imaps) with this:
Code:
-- to debug POP3 --
# telnet x.x.x.x 110
user USERNAME
pass PASSWORD
stat
quit

-- to debug IMAP --
# telnet x.x.x.x 143
a login USERNAME PASSWORD
a examine inbox
a logout

-- to debug POP3 over SSL --
# openssl s_client -connect x.x.x.x:995
(then use same commands as POP3 example)

-- to debug IMAP over SSL --
# openssl s_client -connect x.x.x.x:993
(then use same commands as IMAP example)
and see what happend in first window (both using valid and invalid credential).
Reply With Quote
  #6  
Old 15th November 2011, 21:53
kokusoft kokusoft is offline
Junior Member
 
Join Date: Dec 2010
Posts: 10
Thanks: 0
Thanked 0 Times in 0 Posts
 
Default

[root@server log]# telnet localhost pop3
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
+OK Dovecot ready.
user user1@mydomain.ro
+OK
pass user1password
+OK Logged in.
stat
+OK 105 23802727
quit
+OK Logging out.
Connection closed by foreign host.
You have new mail in /var/spool/mail/root


tail -f /var/log/maillog


Nov 15 21:44:06 server dovecot: pop3-login: Login: user=<userxxx@mydomain.ro>, method=PLAIN, rip=1.2.3.4, lip=192.168.100.xxx
Nov 15 21:44:07 server dovecot: POP3(userxxx@mydomain.ro): Disconnected: Logged out top=0/0, retr=0/0, del=0/1693, size=775238220
Nov 15 21:45:01 server dovecot: pop3-login: Login: user=<user1@mydomain.ro>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
Nov 15 21:45:01 server dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Nov 15 21:45:01 server dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Nov 15 21:45:01 server postfix/smtpd[26705]: connect from localhost.localdomain[127.0.0.1]
Nov 15 21:45:01 server postfix/smtpd[26705]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
Nov 15 21:45:01 server postfix/smtpd[26705]: disconnect from localhost.localdomain[127.0.0.1]
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
MySQL Error Nolan Installation/Configuration 13 27th November 2014 06:04
FTP Problems wabz Installation/Configuration 6 11th January 2010 19:51
Postfix can't received email from exterior astra2000 Server Operation 5 18th October 2009 00:26
Unable to receve email aberrio Server Operation 16 8th July 2009 11:26
slow download through webserver problem snewp Technical 14 9th May 2008 06:25


All times are GMT +2. The time now is 20:19.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.