Plesk Onyx 17.5, Debian 8 x64
Since about a week retrieving or just checking for mails is very slow on my server. The client is Outlook 2007, server is Dovecot POP3. Of course I already restarted Dovecot.
I checked the /var/log/mail.info file, but nothing suspicious there. When I check mails from two different mail accounts, which usually took only a second or less, I have these log lines (and it takes 23 seconds for the two accounts):
I wonder about the lines with "Disconnect" and "Logout", which are only one second after the corresponding "Login" lines, although the checking of the account takes so long.
Between the lines there is always something like this, but I guess it's the "normal" nonstop attacking:
Any ideas what could be wrong?
Since about a week retrieving or just checking for mails is very slow on my server. The client is Outlook 2007, server is Dovecot POP3. Of course I already restarted Dovecot.
I checked the /var/log/mail.info file, but nothing suspicious there. When I check mails from two different mail accounts, which usually took only a second or less, I have these log lines (and it takes 23 seconds for the two accounts):
Code:
Sep 30 17:21:16 myservername dovecot: pop3-login: Login: user=<[email protected]>, method=DIGEST-MD5, rip=xx.0.17.xx, lip=xx.7.13.xx, mpid=10931, TLS, session=<VFJrPRh3bv1bABFz>
Sep 30 17:21:17 myservername dovecot: service=pop3, [email protected], ip=[xx.0.17.xx]. Disconnected: Logged out rcvd=12, sent=43, top=0/0, retr=0/0, del=0/0, size=0
Sep 30 17:21:38 myservername dovecot: pop3-login: Login: user=<[email protected]>, method=DIGEST-MD5, rip=xx.0.17.xx, lip=xx.7.13.xx, mpid=11041, TLS, session=<J263Phh3cP1bABFz>
Sep 30 17:21:39 myservername dovecot: service=pop3, [email protected], ip=[xx.0.17.xx]. Disconnected: Logged out rcvd=12, sent=43, top=0/0, retr=0/0, del=0/0, size=0
I wonder about the lines with "Disconnect" and "Logout", which are only one second after the corresponding "Login" lines, although the checking of the account takes so long.
Between the lines there is always something like this, but I guess it's the "normal" nonstop attacking:
Code:
Sep 30 17:23:10 myservername postfix/smtpd[11467]: connect from unknown[185.36.81.145]
Sep 30 17:23:10 myservername plesk_saslauthd[11469]: listen=6, status=5, dbpath='/plesk/passwd.db', keypath='/plesk/passwd_db_key', chroot=1, unprivileged=1
Sep 30 17:23:10 myservername plesk_saslauthd[11469]: privileges set to (109:115) (effective 109:115)
Sep 30 17:23:10 myservername plesk_saslauthd[11469]: failed mail authenticatication attempt for user 'ming' (password len=5)
Sep 30 17:23:10 myservername postfix/smtpd[11467]: warning: unknown[185.36.81.145]: SASL LOGIN authentication failed: authentication failure
Sep 30 17:23:10 myservername postfix/smtpd[11467]: lost connection after AUTH from unknown[185.36.81.145]
Sep 30 17:23:10 myservername postfix/smtpd[11467]: disconnect from unknown[185.36.81.145]
Any ideas what could be wrong?