Re: Knowing who is failing Auth Logins

On Wed, 19 Jan 2011, Rob Arends wrote:

> Hello,
> 
> IΒ’m running xmail 1.27 on RHEL5.5
> 
> The SMTP logs are showing a single AUTH=EFAIL:TYPE=LOGIN every hour at xx:00 hours.
> 
> It is coming from the same PC I believe, although IP changes, the ISP and area indicated by the
> rDNS suggests it is the same PC.
> 
> Most mail clients attempt POP3 more than once an hour, so IΒ’m suspicious.
> 
> The logs donΒ’t indicate the username in the login attempt.
> 
> Is there any way to report on the username that is being used in the attempt.
> 
> If nothing else I can contact the user.Β 
> 
> However if it is a low speed dictionary attack, IΒ’d like to be able to identify that and take
> some action.

Yeah, I can see that as being useful. Will add to my queue.

- Davide

_______________________________________________
xmail mailing list
[email protected]
http://xmailserver.org/mailman/listinfo/xmail