Repeated POP3 login failures not detected

This forum is only for reproducible bugs with csf and lfd (i.e. not iptables problems, lack of understanding how to use a feature, etc). Posts must be accompanied with full technical details of the problem and how it can be recreated. Any posts not adhering to this, or not considered bugs, will be moved to the General Discussion (csf) forum.
Post Reply
philh
Junior Member
Posts: 14
Joined: 14 Aug 2018, 11:59

Repeated POP3 login failures not detected

Post by philh »

Hi

Repeated maillog entries of the following form were not detected when they should have been (obfuscated):

Code: Select all

Jun  6 13:28:17 vps dovecot: pop3-login: Disconnected: Connection closed: read(size=984) failed: Connection reset by peer (auth failed, 1 attempts in 2 secs): user=<someone@example.com>, method=PLAIN, rip=1.2.3.4, lip=5.6.7.8, session=<FzFMJ3X9oKuwgfnA>
Log entries like this are rare.

CentOS Linux release 7.9.2009
cPanel 110.0.7
dovecot 2.3.19.1
Post Reply