Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a way to get info on the source of authentication failures (SASL, IMAP/POP3 mailbox access) and at the same time the username from Dovecot logs? I have a 2.2.4 installation (+ Postfix), with "auth_verbose" switched on in the main section, authentication through SQL, and I get lines like the following after unsuccesful authentication:

1.

Aug  1 14:00:27 mx1 dovecot: auth-worker(18980): sql(user1@domain1,8.8.8.8): unknown user
Aug  1 14:00:53 mx1 dovecot: auth-worker(18980): sql(user2@domain2,8.8.8.8): Password mismatch

depending on whether the user doesn't exist in the database, or the password was not correct. In the case of POP3/IMAP mailbox access, after one/three such lines I get lines like these:

2.

Aug  1 13:56:14 mx1 dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<user1@domain1>, method=PLAIN, rip=8.8.8.8, lip=4.4.4.4, session=<fy6Kh+HirgBN/uIC>
Aug  1 13:57:51 mx1 dovecot: imap-login: Aborted login (auth failed, 3 attempts in 14 secs): user=<user2@domain2>, method=PLAIN, rip=8.8.8.8, lip=4.4.4.4, session=<xzxhjOHi3AFVTUWA>

From this I can create e.g. a daily report on users failing to authenticate their access to mailboxes, together with usernames, remote IPs, and protocol used, in order to e.g. spot client config problems, or dictionary attacks etc.

However, for SASL (outgoing mail) I only get lines like in the example 1. above. Without a wider analysis (checking whether a line like in 2. follows) I cannot know whether the line is a failure to authenticate via SASL for sending mail, or for IMAP/POP3 mailbox access. I could try to extract this information from Postfix logs, but they don't contain the username. Is there a way to make Dovecot write a line to log that would look like the lines in example 2, but for SASL/outgoing mail?

share|improve this question
    
What do you mean by "Is there a way to make Dovecot write ... for SASL/outgoing mail"? Dovecot doesn't send any mail –  ALex_hha Aug 1 '13 at 15:34
    
Of course it doesn't, but it authenticates senders of email via SASL. –  gstaniak Aug 1 '13 at 22:37
    
Dovecot logs depends on the next config options: log_path, info_log_path and debug_log_path. Ensure that all of them are properly set. Also verify that protocol_imap hasn't his particular options set to the /dev/null –  Kondybas Aug 23 '13 at 0:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.