Issue errors in log about dovecot

[raykai]

hi im getting some dovecot log errors:

Feb 24 21:06:34  dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<q2y2S1FJ5ox/AAAB>
Feb 24 21:06:34  dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<1Z+2S1FJNJF/AAAB>
Feb 24 21:06:35  dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<7Wa3S1FJLNt/AAAB>
Feb 24 21:06:35  dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<MZS3S1FJZJB/AAAB>

Just wandering if this is normal ?

 

[Bitpalast]

Login attempt without a user name. Possibly a malware trying to login, but likely a user who has not set a user name for the login in his mail client.

 

[raykai]

im the only one that uses the mail server its showing the ip :127.0.0.1 so how can i figure out more whats going on with it ?

i have about 4 of these errors every 3 seconds in my logs.

 

[Bitpalast]

Do you have a website that has the capability of checking into mailboxes? For example your own webmail software installation?

 

[raykai]

only one is the one that comes with plesk roundcube (1.2.2)

i only have WordPress and a Phpbb forum on my server for now.

when your talking about a possibility of a malware trying to login, would this malware be hosted on my server ?

 

[Bitpalast]

Yes, it must be a software residing on localhost, else you would not see 127.0.0.1 twice in the log lines. It can however also be a mail module of some sort, for instance a software that can check bounces from newsletters or bounces from forum registration mails. That might simply be unconfigured, so that it tries to login but as the configuration data is missing, it does not know what access credentials it uses. Unfortunately I do not know phpbb well enough whether that has a bounce feature.

 

[Jllynch]

I'm getting this too on a brand new server. Could it be mailman?

 

[bttman]

Hi, having the same problem. Anyone got this resolved ?

 

[G J Piper]

Are there any indicators in /var/log/messages ? Maybe SELinux blocking a local function.