Issue Problem: SASL PLAIN authentication failed

[net97]

Server operating system version

Debian 11.11

Plesk version and microupdate number

Plesk Obsidian 18.0.66 Web Host Edition

hi,

we have the following issue:

Two Users on our Plesk-Server were banned/blocked several times a day by sending/reveiving emails. in the maillog i found the following entry:

Dec 19 08:56:00 srv1 postfix/smtpd[2624657]: warning: pdxxxx8a3.dip0.t-ipconnect.de[xxx.xxx.xx.xxx]: SASL PLAIN authentication failed: authentication failure, sasl_username=[email protected]

if the user go to their website, they become the following Screen and about 30 seconds later, the access will work again for a few hours.

can someone help me to solve the problem?

thanks in advance
Ralph

 

[Vladimir C.]

Hello! It looks blocked by fail2ban policy when someone try to login via mail client using wrong password and after some failed attempts fail2ban block it for specified period of time. Please check Fail2ban configuration:

(Plesk for Linux) Protection Against Brute Force Attacks (Fail2Ban)

IP address banning (or Fail2Ban) is a tool protecting your server and the hosted websites from brute-force attacks.

docs.plesk.com

It is possible to add specific IP addresses to the white list to never block them:

(Plesk for Linux) Protection Against Brute Force Attacks (Fail2Ban)

IP address banning (or Fail2Ban) is a tool protecting your server and the hosted websites from brute-force attacks.

docs.plesk.com

 

[net97]

hi,

thank you for your reply. Unfortunately the IP-Adresses in Germany are mostly dynamic, so it doesn´t make sense to whitelist an IP-Adress.
and in the failban.log is nothing conspicuous about the IP.

 

[Vladimir C.]

Thank you for update! Without detailed logs analysis it's hard to identify cause of the issue. The message from log you've sent itself cannot lead to the issue with blocking mail functionality. I would recommend contact Plesk technical support team to speed up investigation.