2

I was recently going over some old mail logs, and I came across this:

Jun 12 14:51:56 hostname imapd: LOGIN FAILED, user=Purple, ip=[::ffff:127.0.0.1]
Jun 12 14:51:56 hostname postfix/smtpd[21538]: disconnect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:51:58 hostname postfix/smtpd[21536]: connect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:02 hostname postfix/smtpd[21537]: disconnect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:03 hostname imapd: LOGIN FAILED, user=Sports, ip=[::ffff:127.0.0.1]
Jun 12 14:52:07 hostname postfix/smtpd[21559]: connect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:09 hostname postfix/smtpd[21536]: disconnect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:11 hostname imapd: LOGIN FAILED, user=dragon, ip=[::ffff:127.0.0.1]
Jun 12 14:52:14 hostname postfix/smtpd[21562]: connect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:17 hostname postfix/smtpd[21559]: disconnect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:18 hostname imapd: LOGIN FAILED, user=michael, ip=[::ffff:127.0.0.1]

Why would courier-imapd be reporting login failures coming from 127.0.0.1?

Edit: While squirrelmail is installed, it's restricted to one IP address, and there are no logs indicating it has been accessed. Further, I'm the sole user of the machine so it's definitely not me. :-)

5 Answers 5

1

squirrel (or any other) webmail comes to my mind...

1
  • While installed, it's IP address restricted, and there are no logs of it being accessed.
    – etheros
    Jul 1, 2010 at 11:04
1

You probably have a webmail installed in the same server, so authentication are comming from localhost (127.0.0.1 is localhost)

2
  • Squirrelmail is installed, but it's restricted to one IP address, and there are no logs to indicate that it's been accessed.
    – etheros
    Jul 1, 2010 at 11:05
  • You can try to track which from which application the connection is comming with a tool such a lsof
    – radius
    Jul 1, 2010 at 11:13
0

As it has been mentioned, it would have to be something on the local machine connecting to the mail server via the local loopback (or using "localhost" as the server name).

Most commonly, webmail, but could be anything which has the ability to talk across this "interface" .. Eg: if you were running any MUA on the machine it could be causing this behavior. Or alternatively, if you are running a web server and have code which uses php's imap_open() function and using "localhost" as the mail server name.. or (insert an other language which runs on the machine which could be doing this)

2
  • I'm not entirely sure what it could be. As per my edit, it's not webmail, and being the sole user of the machine, it's not me.
    – etheros
    Jul 1, 2010 at 11:09
  • you could try a command similar to: "netstat -tnp | grep 127.0.0.1" - the output of which should give you some idea which program is creating this connection. The problem with this is you would need to be running it when the connection is actually established, so it is a bit hit and miss.. Alternatively is there a way to increase the verbosity of the logging?! (I am not familiar with courier-imap) Jul 1, 2010 at 11:18
0

Check the web server logs at the same time of imapd fail login. So you can confirm or not the access is made by Squirrelmail and from where.

2
  • Only appears in the mail log.
    – etheros
    Jul 1, 2010 at 12:49
  • Sorry, I didn't read with attention your logs! Now I edited my answer.
    – lg.
    Jul 1, 2010 at 13:15
0

I did some digging and it turns out that Postfix is using SASL for authentication, which is authenticating against the local courier-imapd - hence the logs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .