Hello, We are facing some troubles when our customers try to configure email in MAC, everything works perfectly except these entries that i've found in mail.log: Feb 23 16:08:41 ns1 dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=x.x.x.x, lip=x.x.x.x, TLS: Disconnected, session=<zNYY/TNJmABTMFOV> Feb 23 16:08:41 ns1 dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=x.x.x.x, lip=x.x.x.x, TLS: Disconnected, session=<AwkZ/TNJaABTMFOV> Feb 23 16:08:42 ns1 dovecot: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=x.x.x.x, lip=x.x.x.x, TLS: Disconnected, session=<5z8a/TNJlwBTMFOV> Feb 23 16:08:42 ns1 dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<> rip=x.x.x.x, lip=x.x.x.x, TLS: Disconnected, session=<TOEb/TNJlgBTMFOV> Feb 23 16:08:42 ns1 dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=x.x.x.x, lip=x.x.x.x, TLS: Disconnected, session=<xOwb/TNJaQBTMFOV> Feb 23 16:08:42 ns1 dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=x.x.x.x, lip=x.x.x.x, TLS: Disconnected, session=<OQcd/TNJagBTMFOV> What are we doing wrong? why mac maps the user fild with no text? our customers are being banned with fail2ban for this reason..... 2017-02-23 06:17:42,860 fail2ban.actions: WARNING [dovecot] Unban x.x.x.x 2017-02-23 06:17:49,876 fail2ban.actions: WARNING [dovecot] Ban x.x.x.x 2017-02-23 06:27:50,488 fail2ban.actions: WARNING [dovecot] Unban x.x.x.x 2017-02-23 06:28:01,509 fail2ban.actions: WARNING [dovecot] Ban x.x.x.x 2017-02-23 06:38:01,999 fail2ban.actions: WARNING [dovecot] Unban x.x.x.x 2017-02-23 09:56:17,450 fail2ban.actions: WARNING [dovecot] Ban x.x.x.x 2017-02-23 10:06:18,116 fail2ban.actions: WARNING [dovecot] Unban x.x.x.x 2017-02-23 10:06:19,125 fail2ban.actions: WARNING [dovecot] Ban x.x.x.x 2017-02-23 10:16:19,715 fail2ban.actions: WARNING [dovecot] Unban x.x.x.x 2017-02-23 10:16:22,728 fail2ban.actions: WARNING [dovecot] Ban x.x.x.x 2017-02-23 10:26:23,372 fail2ban.actions: WARNING [dovecot] Unban x.x.x.x 2017-02-23 10:26:24,381 fail2ban.actions: WARNING [dovecot] Ban x.x.x.x 2017-02-23 10:36:25,000 fail2ban.actions: WARNING [dovecot] Unban x.x.x.x 2017-02-23 10:36:27,011 fail2ban.actions: WARNING [dovecot] Ban x.x.x.x 2017-02-23 10:46:27,659 fail2ban.actions: WARNING [dovecot] Unban x.x.x.x 2017-02-23 11:06:37,898 fail2ban.actions: WARNING [dovecot] Ban x.x.x.x Kind regards!!!
I don't have a mac, so I can't check this myself. But I know that many colleagues are using macs and don't have any connection issues to ISPConfig servers. In any way, the problem here is the client which does connects to the server without a username, so you should try to find out why the mac client on that PC behaved like this.
Are you sure these IPs are coming from one of your Mac users? A lot of bots can behave like that. If yes, try to get some information from them, at least the mail client they use, I already used Outlook, Mail and Thunderbird on Mac to access an ISPC account without problem
Yes, these ips are legit.... so i dont know what is going on...for test, i will create a new virtual machine and do some tests... Thanks as always!!!
