View source for Dovecot

Dovecot is a POP3/IMAP server that can also provide authentication for SMTP and other SASL services. See also the [http://wiki.dovecot.org/HowTo/Fail2Ban Fail2Ban page on the Dovecot wiki].

{{Logging_Outputs}}

Dovecot-1.0.0 with pam. Other authentication mechanism probably produce different output.

* Jan 11 03:42:09 email dovecot: auth(default): pam(support@example.org,192.0.2.2): pam_authenticate() failed: User not known to the underlying authentication module
* Jan 26 22:31:37 email dovecot: auth(default): pam(dan,192.0.2.2): pam_authenticate() failed: Authentication failure

Dovecot-1.0.15 with sql, and "auth_verbose = yes":

* Jan 11 03:42:09 email dovecot: auth-worker(default): sql(janfrode@tanso.net,192.168.11.16): Password mismatch
* Jan 11 03:45:09 email dovecot: auth-worker(default): sql(someoneelse,192.168.11.16): unknown user

With successfull logins, it doesn't print anything from "auth-worker".

Dovecot-1.2.13, without pam (slackware), with TLS :
* Jul 31 13:53:08 email dovecot: imap-login: Aborted login (auth failed, 1 attempts): user=<someone>, method=PLAIN, rip=192.168.0.2, lip=192.168.0.1, TLS
* Jul 31 13:54:35 email dovecot: imap-login: Disconnected (tried to use unsupported auth mechanism): user=<someone>, method=LOGIN, rip=192.168.2.2, lip=192.168.2.1, TLS: Disconnected

(rip is the IP address of the client, lip is the IP address of the server)
Same results with "auth_verbose = yes".


{{Failregex}}


<pre>
failregex = dovecot.*auth\(default\): pam\(.*,<HOST>\): pam_authenticate\(\) failed:
</pre>

[[Category:MailServices]]