Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I was recently going over some old mail logs, and I came across this:

Jun 12 14:51:56 hostname imapd: LOGIN FAILED, user=Purple, ip=[::ffff:127.0.0.1]
Jun 12 14:51:56 hostname postfix/smtpd[21538]: disconnect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:51:58 hostname postfix/smtpd[21536]: connect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:02 hostname postfix/smtpd[21537]: disconnect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:03 hostname imapd: LOGIN FAILED, user=Sports, ip=[::ffff:127.0.0.1]
Jun 12 14:52:07 hostname postfix/smtpd[21559]: connect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:09 hostname postfix/smtpd[21536]: disconnect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:11 hostname imapd: LOGIN FAILED, user=dragon, ip=[::ffff:127.0.0.1]
Jun 12 14:52:14 hostname postfix/smtpd[21562]: connect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:17 hostname postfix/smtpd[21559]: disconnect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:18 hostname imapd: LOGIN FAILED, user=michael, ip=[::ffff:127.0.0.1]

Why would courier-imapd be reporting login failures coming from 127.0.0.1?

Edit: While squirrelmail is installed, it's restricted to one IP address, and there are no logs indicating it has been accessed. Further, I'm the sole user of the machine so it's definitely not me. :-)

share|improve this question

5 Answers 5

squirrel (or any other) webmail comes to my mind...

share|improve this answer
    
While installed, it's IP address restricted, and there are no logs of it being accessed. –  etheros Jul 1 '10 at 11:04

You probably have a webmail installed in the same server, so authentication are comming from localhost (127.0.0.1 is localhost)

share|improve this answer
    
Squirrelmail is installed, but it's restricted to one IP address, and there are no logs to indicate that it's been accessed. –  etheros Jul 1 '10 at 11:05
    
You can try to track which from which application the connection is comming with a tool such a lsof –  radius Jul 1 '10 at 11:13

As it has been mentioned, it would have to be something on the local machine connecting to the mail server via the local loopback (or using "localhost" as the server name).

Most commonly, webmail, but could be anything which has the ability to talk across this "interface" .. Eg: if you were running any MUA on the machine it could be causing this behavior. Or alternatively, if you are running a web server and have code which uses php's imap_open() function and using "localhost" as the mail server name.. or (insert an other language which runs on the machine which could be doing this)

share|improve this answer
    
I'm not entirely sure what it could be. As per my edit, it's not webmail, and being the sole user of the machine, it's not me. –  etheros Jul 1 '10 at 11:09
    
you could try a command similar to: "netstat -tnp | grep 127.0.0.1" - the output of which should give you some idea which program is creating this connection. The problem with this is you would need to be running it when the connection is actually established, so it is a bit hit and miss.. Alternatively is there a way to increase the verbosity of the logging?! (I am not familiar with courier-imap) –  Keiran Holloway Jul 1 '10 at 11:18

Check the web server logs at the same time of imapd fail login. So you can confirm or not the access is made by Squirrelmail and from where.

share|improve this answer
    
Only appears in the mail log. –  etheros Jul 1 '10 at 12:49
    
Sorry, I didn't read with attention your logs! Now I edited my answer. –  lg. Jul 1 '10 at 13:15
up vote 0 down vote accepted

I did some digging and it turns out that Postfix is using SASL for authentication, which is authenticating against the local courier-imapd - hence the logs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.