From: Jez N. <jez...@ya...> - 2013-12-20 17:13:33
|
I have installed/configured plugin and can see LOGIN and LOGOUT events in the logfile, but want to log failures for fail2ban to act on. Deliberate invalid passwords with or without a valid username cause the following to be displayed in the web browser: ERROR: Connection dropped by IMAP server. Query: LOGOUT but no entry in the logfile. in plugin config.php, the following are uncommented: $sl_log_events = array( ... 'LOGIN_ERROR', 'ERROR', ... $sl_logs = array( 'FILE' => array( ... 'LOGIN_ERROR' => "%6 [%1] %2 (%3) from %4: %7\n", 'LOGIN_ERROR' => "%6 [INVALID] %2 (%3) from %4: %7\n", ... Plugins Installed Plugins 1. delete_move_next 2. squirrelspell 3. newmail 4. mail_fetch 5. calendar 6. message_details 7. translate 8. info 9. compatibility 10. change_sqlpass 11. html_mail 12. view_as_html 13. smime 14. sent_subfolders 15. file_manager 16. administrator 17. squirrel_logger Sq.M. Version 1.4.22-10.fc19 Plugin Version 2.3 Fedora Version :3.11.10-200.fc19.i686.PAE dovecot-mysql-2.2.7-2.fc19.i686 dovecot-2.2.7-2.fc19.i686 postfix-2.10.2-2.fc19.i686 ispconfig3 3.0.5 |
From: Paul L. <pa...@sq...> - 2013-12-20 18:37:03
|
FYI, this is an issue for the plugins mailing list. On Fri, Dec 20, 2013 at 9:13 AM, Jez Noake <jez...@ya...> wrote: > I have installed/configured plugin and can see LOGIN and LOGOUT events in the logfile, but want to log failures for fail2ban to act on. > Deliberate invalid passwords with or without a valid username cause the following to be displayed in the web browser: > ERROR: Connection dropped by IMAP server. > Query: LOGOUT This is not a login failure event. This is your IMAP server doing something odd. You should diagnose your IMAP logs and configuration to see why it is dropping the connection when entering invalid credentials. > but no entry in the logfile. > > in plugin config.php, the following are uncommented: > > $sl_log_events = array( > ... > > 'LOGIN_ERROR', > 'ERROR', > ... > > > $sl_logs = array( > 'FILE' => array( > ... > > 'LOGIN_ERROR' => "%6 [%1] %2 (%3) from %4: %7\n", > 'LOGIN_ERROR' => "%6 [INVALID] %2 (%3) from %4: %7\n", Do you mean for one of these to be just "ERROR"? > ... > > > Plugins > Installed Plugins > 1. delete_move_next > 2. squirrelspell > 3. newmail > 4. mail_fetch > 5. calendar > 6. message_details > 7. translate > 8. info > 9. compatibility > 10. change_sqlpass > 11. html_mail > 12. view_as_html > 13. smime > 14. sent_subfolders > 15. file_manager > 16. administrator > 17. squirrel_logger > > > > Sq.M. Version 1.4.22-10.fc19 > Plugin Version 2.3 > Fedora Version :3.11.10-200.fc19.i686.PAE > dovecot-mysql-2.2.7-2.fc19.i686 > dovecot-2.2.7-2.fc19.i686 > postfix-2.10.2-2.fc19.i686 > > ispconfig3 3.0.5 -- Paul Lesniewski SquirrelMail Team Please support Open Source Software by donating to SquirrelMail! http://squirrelmail.org/donate_paul_lesniewski.php |