plesk_saslauthd

[EricVis]

I found some weird entries in the maillog
SMTP relay OFF
IMAP/POP3 OFF
no mailboxes on the server, only PHP sends some emails out
===

I think this below is correct, login failure so nothing else happens:

May 15 12:38:16 vis2 postfix/smtpd[17492]: warning: unknown[97.66.250.155]: SASL LOGIN authentication failed: authentication failure
May 15 12:38:16 vis2 postfix/smtpd[17492]: disconnect from unknown[97.66.250.155]
May 15 12:38:46 vis2 plesk_saslauthd[17494]: activity on 0 channel(s)
May 15 12:38:46 vis2 plesk_saslauthd[17494]: select timeout, exiting

but here there is lots of activity after login failed:

May 15 12:38:16 vis2 postfix/smtpd[17492]: warning: unknown[97.66.250.155]: SASL LOGIN authentication failed: authentication failure
May 15 12:38:16 vis2 plesk_saslauthd[17494]: activity on 1 channel(s)
May 15 12:38:16 vis2 plesk_saslauthd[17494]: new client (fd=10) registered
May 15 12:38:16 vis2 plesk_saslauthd[17494]: main cycle iteration
May 15 12:38:16 vis2 plesk_saslauthd[17494]: activity on 1 channel(s)
May 15 12:38:16 vis2 plesk_saslauthd[17494]: some read activity on client 10
May 15 12:38:16 vis2 plesk_saslauthd[17494]: read(10, &buf, 2)=2
May 15 12:38:16 vis2 plesk_saslauthd[17494]: processing client data chunk [state=0]
May 15 12:38:16 vis2 plesk_saslauthd[17494]: read(10, &buf, 7)=7
May 15 12:38:16 vis2 plesk_saslauthd[17494]: processing client data chunk [state=1]
May 15 12:38:16 vis2 plesk_saslauthd[17494]: read(10, &buf, 2)=2
May 15 12:38:16 vis2 plesk_saslauthd[17494]: processing client data chunk [state=2]
May 15 12:38:16 vis2 plesk_saslauthd[17494]: read(10, &buf, 10)=10
May 15 12:38:16 vis2 plesk_saslauthd[17494]: processing client data chunk [state=3]
May 15 12:38:16 vis2 plesk_saslauthd[17494]: read(10, &buf, 2)=2
May 15 12:38:16 vis2 plesk_saslauthd[17494]: processing client data chunk [state=4]
May 15 12:38:16 vis2 plesk_saslauthd[17494]: read(10, &buf, 4)=4
May 15 12:38:16 vis2 plesk_saslauthd[17494]: processing client data chunk [state=5]
May 15 12:38:16 vis2 plesk_saslauthd[17494]: read(10, &buf, 2)=2
May 15 12:38:16 vis2 plesk_saslauthd[17494]: processing client data chunk [state=6]
May 15 12:38:16 vis2 plesk_saslauthd[17494]: processing client data chunk [state=7]
May 15 12:38:16 vis2 plesk_saslauthd[17494]: Invalid mail address 'support@'
May 15 12:38:16 vis2 plesk_saslauthd[17494]: main cycle iteration
May 15 12:38:16 vis2 plesk_saslauthd[17494]: activity on 1 channel(s)
May 15 12:38:16 vis2 plesk_saslauthd[17494]: some write activity on client 10
May 15 12:38:16 vis2 plesk_saslauthd[17494]: attempt to write(10, &buf, 4)
May 15 12:38:16 vis2 plesk_saslauthd[17494]: client 10 processed
May 15 12:38:16 vis2 plesk_saslauthd[17494]: main cycle iteration

why there is so many entries above when auth failed?

 

[IgorG]

Check it - http://kb.parallels.com/113866

 

[EricVis]

Check it - http://kb.parallels.com/113866

I hav eplesk 11 not 10 and smtp on localhost works properly
these requests in the log come form outside and once they failed to auth should be dienid/ignored/rejected but instead there is lots of log after failure

just to be clear, emails are sending perfectly fine from this server, this is rather security concern for me, not understanding why this is happening

 

[RonnieB]

Hi there,

i'm running PLESK 11.5.30 Update #29 and have the same issue as EricVis.
I can use my email send and recieve. here is the log:


Feb 4 07:45:19 MY_SERVER postfix/smtpd[32143]: warning: ip-static-94-242-238-175.as5577.net[94.242.238.175]: SASL LOGIN authentication failed: authentication failure
Feb 4 07:45:19 MY_SERVER plesk_saslauthd[32028]: main cycle iteration
Feb 4 07:45:20 MY_SERVER postfix/smtpd[32137]: lost connection after AUTH from ip-static-94-242-238-175.as5577.net[94.242.238.175]
Feb 4 07:45:20 MY_SERVER postfix/smtpd[32137]: disconnect from ip-static-94-242-238-175.as5577.net[94.242.238.175]
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: activity on 1 channel(s)
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: new client (fd=10) registered
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: main cycle iteration
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: activity on 1 channel(s)
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: some read activity on client 10
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: read(10, &buf, 2)=2
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: processing client data chunk [state=0]
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: read(10, &buf, 8)=8
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: processing client data chunk [state=1]
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: read(10, &buf, 2)=2
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: processing client data chunk [state=2]
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: read(10, &buf, 6)=6
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: processing client data chunk [state=3]
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: read(10, &buf, 2)=2
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: processing client data chunk [state=4]
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: read(10, &buf, 4)=4
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: processing client data chunk [state=5]
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: read(10, &buf, 2)=2
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: processing client data chunk [state=6]
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: processing client data chunk [state=7]
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: Invalid mail address 'software@'
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: main cycle iteration
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: activity on 1 channel(s)
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: some write activity on client 10
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: attempt to write(10, &buf, 4)
Feb 4 07:45:20 MY_SERVER plesk_saslauthd[32028]: client 10 processed


I cant figure out what the problem is here, so if any one can help me out.