In my dovecot.conf I do not have pop3-login anabled (since I do not support
pop3):
# doveconf -n
# 2.2.5: /usr/local/etc/dovecot/dovecot.conf
# OS: FreeBSD 9.1-RELEASE i386
auth_mechanisms = CRAM-MD5 DIGEST-MD5 APOP LOGIN PLAIN
disable_plaintext_auth = no
first_valid_uid = 89
log_path = /var/log/dovecot
login_log_format_elements = user=<%u> %r %m %c
mail_location = maildir:~/Maildir
mail_max_userip_connections = 50
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character
vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy
include variables body enotify environment mailbox date ihave
namespace inbox {
inbox = yes
location =
mailbox Drafts {
special_use = \Drafts
}
mailbox Junk {
auto = subscribe
special_use = \Junk
}
mailbox NotJunk {
auto = subscribe
}
mailbox Sent {
special_use = \Sent
}
mailbox "Sent Messages" {
special_use = \Sent
}
mailbox Trash {
special_use = \Trash
}
prefix =
}
passdb {
driver = pam
}
passdb {
args = /etc/dovecot/dovecot-sql.conf.ext
driver = sql
}
service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0666
}
}
service imap-login {
inet_listener imaps {
port = 993
ssl = yes
}
}
ssl_cert = </etc/ssl/certs/dovecot.pem
ssl_key = </etc/ssl/private/dovecot.pem
userdb {
driver = passwd
}
userdb {
args = /etc/dovecot/dovecot-sql.conf.ext
default_fields = uid=vpopmail gid=vchkpw mail_location=/usr/local/virtual/%u
driver = sql
}
but I see thousands (tens of thousands) of
dovecot:Aug 18 14:26:06 pop3-login: Info: Aborted login (auth failed, 1
attempts in 17 secs): user=<john>, method=PLAIN, rip=74.95.82.150,
lip=75.148.117.93, session=<+VcroT7kUgBKX1KW>
dovecot:Aug 18 14:26:10 pop3-login: Info: Aborted login (auth failed, 1
attempts in 17 secs): user=<john>, method=PLAIN, rip=74.95.82.150,
lip=75.148.117.93, session=<kbNdoT7kWwBKX1KW>
dovecot:Aug 18 14:26:13 pop3-login: Info: Aborted login (auth failed, 1
attempts in 17 secs): user=<john>, method=PLAIN, rip=74.95.82.150,
lip=75.148.117.93, session=<rRWQoT7kWgBKX1KW>
dovecot:Aug 18 14:26:15 pop3-login: Info: Aborted login (auth failed, 1
attempts in 17 secs): user=<john>, method=PLAIN, rip=74.95.82.150,
lip=75.148.117.91, session=<feCpoT7kfwBKX1KW>
dovecot:Aug 18 14:26:16 pop3-login: Info: Aborted login (auth failed, 1
attempts in 17 secs): user=<john>, method=PLAIN, rip=74.95.82.150,
lip=75.148.117.93, session=<lmTCoT7kiQBKX1KW>
dovecot:Aug 18 14:26:18 pop3-login: Info: Aborted login (auth failed, 1
attempts in 17 secs): user=<john>, method=PLAIN, rip=74.95.82.150,
lip=75.148.117.91, session=<5oPcoT7ktABKX1KW>
Yes, I need to install fail2ban or something on this new machine, but still...
--
Mom: There was more than one lobster present at the birth of Jesus?
Daughter: Duh.
