On 23/01/2024 09:23, Joseph Tam wrote:
My guess is Outlook is doing some
autodiscovery/autoconfiguration thing, and
occasionally hits the right combo and successfully authenticates.
I think, the intention is to make life of users easier: no need to
remember authentication type, starttls or
From: Steve Dondley
> I have no idea what is triggering it for so many different users from legit
> email addresses. Still investigating. But this appears to be a fail2ban
> problem, not a dovecot problem.
My logs are filled with failed authentication from Outlook clients. The clients
seem to
Yeah I think I figured it out. It looks like someone set up their phone with
bad password and when they got on the WiFi network it got everyone else on the
network banned for 10 min. I’ve whitelisted the ip for now. I think the guy was
traveling between different offices making it look like it
On Mon, Jan 22, 2024 at 04:28:09PM -0500, Steve Dondley via dovecot wrote:
> OK, I was chasing log ghosts. What was actually going on was fail2ban was
> kicking on for users and banning them for 10 min.
>
> I have no idea what is triggering it for so many different users from legit
> email
OK, I was chasing log ghosts. What was actually going on was fail2ban was
kicking on for users and banning them for 10 min.
I have no idea what is triggering it for so many different users from legit
email addresses. Still investigating. But this appears to be a fail2ban
problem, not a dovecot
Based on your email I went back and took a closer took at the logs.
The client reported this happened at 11:58 of the 19th. I went back and took a
closer look and around 11:56 I found these entries in the log.
81218 Jan 18 11:56:56 ip-172-30-0-131 dovecot: imap(t.oli)<3739040>: Connection
> On 22/01/2024 17:16 EET Steve Dondley via dovecot wrote:
>
>
> > there is no user in the above line
> >
> >> Some characteristics of the problem that may offer a clue:
> >> * happening with multiple users, not just the same one
> >> * happens from different IP addresses.
> >
> > bots
> there is no user in the above line
>
>> Some characteristics of the problem that may offer a clue:
>> * happening with multiple users, not just the same one
>> * happens from different IP addresses.
>
> bots detected
The problem is happening to real users on real devices who are reporting
Steve Dondley via dovecot skrev den 2024-01-22 02:18:
I have a mail server using dovecot that has been running without issue
for quite a couple of years now. It serves email for about 30
individuals.
But since Jan 14th, users have been reporting spurious errors in MS
Outlook:
324 Jan 21
I have a mail server using dovecot that has been running without issue for
quite a couple of years now. It serves email for about 30 individuals.
But since Jan 14th, users have been reporting spurious errors in MS Outlook:
316 Jan 21 00:38:12 ip-172-30-0-131 dovecot: pop3-login: Disconnected
10 matches
Mail list logo
