On 08/05/2005 05:28 AM, Alexander Dalloz wrote:
> pam_abl would/should only blacklist those hosts or users with over the
> limit failed login/auth attempts. You say each IMAP connection to the
> dovecot server triggers a failed attempt and leads to blocking the user?
Yes. Here is the result of 'pam_abl -v' shortly after user magnus was
denied access.
Reading config from /etc/security/pam_abl.conf
Failed users:
lars (9)
Sat Aug 6 07:55:06 2005
Fri Aug 5 10:30:01 2005
Thu Aug 4 23:04:18 2005
Thu Aug 4 22:31:40 2005
Thu Aug 4 22:31:36 2005
Thu Aug 4 22:31:34 2005
Thu Aug 4 22:31:33 2005
Thu Aug 4 22:31:21 2005
Thu Aug 4 22:30:02 2005
magnus (40)
Sat Aug 6 14:07:09 2005
Sat Aug 6 14:07:04 2005
Sat Aug 6 14:01:31 2005
Sat Aug 6 13:59:29 2005
Sat Aug 6 13:57:28 2005
Sat Aug 6 13:55:27 2005
Sat Aug 6 13:53:20 2005
Sat Aug 6 13:51:03 2005
Sat Aug 6 13:49:01 2005
Sat Aug 6 13:45:00 2005
Sat Aug 6 13:44:58 2005
Fri Aug 5 20:48:54 2005
Fri Aug 5 20:46:52 2005
Fri Aug 5 20:44:32 2005
Fri Aug 5 20:42:30 2005
Fri Aug 5 20:40:25 2005
Fri Aug 5 20:38:14 2005
Fri Aug 5 20:38:13 2005
Fri Aug 5 18:37:02 2005
Fri Aug 5 18:36:58 2005
Fri Aug 5 18:35:02 2005
Fri Aug 5 18:34:58 2005
Fri Aug 5 18:32:56 2005
Fri Aug 5 18:32:51 2005
Fri Aug 5 18:14:29 2005
Fri Aug 5 18:12:11 2005
Fri Aug 5 18:10:07 2005
Fri Aug 5 18:07:48 2005
Fri Aug 5 18:05:55 2005
Fri Aug 5 18:05:54 2005
Fri Aug 5 17:51:43 2005
Fri Aug 5 17:47:27 2005
Fri Aug 5 17:45:09 2005
Fri Aug 5 17:43:07 2005
Fri Aug 5 17:41:12 2005
Fri Aug 5 17:41:10 2005
Thu Aug 4 22:05:33 2005
Thu Aug 4 22:03:29 2005
Thu Aug 4 22:01:26 2005
Thu Aug 4 22:01:22 2005
Failed hosts:
------------
And here is the result of 'grep imap /var/log/maillog'
Aug 4 21:45:32 server imap-login: Disconnected [81.216.166.177]
Aug 4 21:46:11 server imap-login: Disconnected [81.216.166.177]
Aug 4 22:01:22 server imap-login: Login: magnus [81.216.166.177]
Aug 4 22:01:26 server imap-login: Login: magnus [81.216.166.177]
Aug 4 22:03:29 server imap-login: Login: magnus [81.216.166.177]
Aug 4 22:05:33 server imap-login: Login: magnus [81.216.166.177]
Aug 4 22:28:23 server imap-login: Aborted login [127.0.0.1]
Aug 4 22:30:02 server imap-login: Aborted login [127.0.0.1]
Aug 4 22:31:21 server imap-login: Aborted login [127.0.0.1]
Aug 4 22:31:33 server imap-login: Login: lars [127.0.0.1]
Aug 4 22:31:40 server imap-login: Login: lars [127.0.0.1]
Aug 4 23:04:18 server imap-login: Login: lars [192.168.0.9]
Aug 5 10:30:01 server imap-login: Login: lars [192.168.0.9]
Aug 5 17:41:10 server imap-login: Login: magnus [81.216.166.177]
Aug 5 17:41:12 server imap-login: Login: magnus [81.216.166.177]
Aug 5 17:43:07 server imap-login: Login: magnus [81.216.166.177]
Aug 5 17:45:09 server imap-login: Login: magnus [81.216.166.177]
Aug 5 17:47:27 server imap-login: Login: magnus [81.216.166.177]
Aug 5 17:51:43 server imap-login: Login: magnus [81.216.166.177]
Aug 5 18:05:54 server imap-login: Login: magnus [81.216.166.177]
Aug 5 18:10:07 server imap-login: Login: magnus [81.216.166.177]
Aug 5 18:12:13 server imap-login: Disconnected [81.216.166.177]
Aug 5 18:14:30 server imap-login: Disconnected [81.216.166.177]
Aug 5 18:32:53 server imap-login: Disconnected [81.216.166.177]
Aug 5 18:35:03 server imap-login: Disconnected [81.216.166.177]
Aug 5 18:36:59 server imap-login: Disconnected [81.216.166.177]
Aug 5 18:37:59 server imap-login: Disconnected: Inactivity [81.216.166.177]
Aug 5 20:38:13 server imap-login: Login: magnus [81.216.166.177]
Aug 5 20:42:30 server imap-login: Login: magnus [81.216.166.177]
Aug 5 20:44:32 server imap-login: Login: magnus [81.216.166.177]
Aug 5 20:46:52 server imap-login: Login: magnus [81.216.166.177]
Aug 5 20:48:54 server imap-login: Login: magnus [81.216.166.177]
Aug 6 07:55:06 server imap-login: Login: lars [192.168.0.9]
Aug 6 13:44:58 server imap-login: Login: magnus [81.216.166.177]
Aug 6 13:45:00 server imap-login: Login: magnus [81.216.166.177]
Aug 6 13:49:01 server imap-login: Login: magnus [81.216.166.177]
Aug 6 13:51:03 server imap-login: Login: magnus [81.216.166.177]
Aug 6 13:53:20 server imap-login: Login: magnus [81.216.166.177]
Aug 6 13:55:28 server imap-login: Disconnected [81.216.166.177]
Aug 6 13:57:36 server imap-login: Disconnected [81.216.166.177]
Aug 6 14:00:06 server imap-login: Disconnected [81.216.166.177]
Aug 6 14:02:28 server imap-login: Disconnected: Inactivity [81.216.166.177]
Aug 6 14:07:06 server imap-login: Disconnected [81.216.166.177]
Aug 6 14:07:10 server imap-login: Disconnected [81.216.166.177]
-------------
As you can see even the successful logins seem to be counted.
> The PAM setup looks proper. What did you configure with pam_abl.conf?
At the moment, nothing, it is the default.
Nothing in the dovecot.conf file, regarding authorizing, have been changed.
I will see if I can find something here causing this, if not I will put
it all into bugzilla.
Lars
--
Lars E. Pettersson <lars@xxxxxxxx>
http://www.sm6rpz.se/
