Date:  Sat, 15 Aug 2009 09:34:48 +1000
From:  Greg Kuhnert <greg.kuhnert (at mark) theanchoragesylvania.com>
Subject:  [coba-e:15887] Re: Block Hacker IP from BQ and BX Server
To:  "Darrell D. Mobley" <dmobley (at mark) uhostme.com>
Cc:  coba-e (at mark) bluequartz.org
Message-Id:  <4A85F498.2060009 (at mark) theanchoragesylvania.com>
In-Reply-To:  <5D1AFDCEFF6842F0A19B3AC3A086C636@HP9925NR>
References:  <2DAB4EF3-1B30-4A80-9B28-05C1CAC2B271 (at mark) housleyconsulting.com.au> <BAY107-W428D49C8AE2A6E64E87003D1070 (at mark) phx.gbl> <C81E2DF7ABD74911BB472BEC43ABD0A2 (at mark) HP9925NR> <4A8333EF.1040905 (at mark) theanchoragesylvania.com> <4AC0EE4443374853B240370C4E373A02 (at mark) HP9925NR> <5D1AFDCEFF6842F0A19B3AC3A086C636 (at mark) HP9925NR>
X-Mail-Count: 15887

Darrell D. Mobley wrote:
> It happened again this morning:
>
> Aug 14 04:14:33 www dovecot: pop3-login: Disconnected: user=<admin>,
> method=PLAIN, rip=213.92.11.165, lip=208.77.219.100
>   

If we look at that line, it is saying that this user disconnected. If 
their username was provided, can we assume that they were valid logins? 
Previously, dovecot told us that there was an auth failure if a username 
is provided on a failed login attempt?

I do not see this happening on my test box.

rpm -q dovecot
dovecot-1.1.8-0BQ3

What dovecot version are you running?

--
+---------------------------------------------------------------------+
|   / \   Greg Kuhnert, gkuhnert (at mark) compassnetworks.com.au               |
| <  o  > Compass Networks - Pointing you in the right direction      |
|   \ /   Come see us for BlueQuartz / BlueOnyx modules & Support.    |
+---------------------------------------------------------------------+