dovecot: "auth failed" messages coming from router
by Robert S from LinuxQuestions.org on (#6KB8C)
I'm getting a whole lot of these messages (Dovecot 2.3.20):
Quote:
where 192.168.0.40 is my server, and 192.168.0.1 is the IP address of my router.
Where are these coming from, and do they represent a "brute force" attack from outside?
Quote:
| Mar 12 20:37:01 MYSERVER auth[6883]: pam_unix(imap:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=MYUSERNAME rhost=192.168.0.1 user=MYUSERNAME Mar 12 20:37:05 MYSERVER dovecot[28998]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<MYUSERNAME>, method=PLAIN, rip=192.168.0.1, lip=192.168.0.40, TLS: Connection closed, session=<LxtwZnMTLMXAqAAB> |
Where are these coming from, and do they represent a "brute force" attack from outside?