Results 1 to 1 of 1
I'm running Postfix on Ubuntu 6.06-server. This morning Logwatch showed the following:
"Connections: 4 Times
Protocol IMAP - 4 Times
Host 216.150.139.113 - 1 Time -------> unknown client (From Xand ...
- 09-17-2009 #1Just Joined!
- Join Date
- Sep 2009
- Posts
- 1
Postfix - unknown login
I'm running Postfix on Ubuntu 6.06-server. This morning Logwatch showed the following:
"Connections: 4 Times
Protocol IMAP - 4 Times
Host 216.150.139.113 - 1 Time -------> unknown client (From Xand corporation's range actually)
Host 192.168.xxx.xxx - 3 Times -----> my client "
Postfix mail.log shows the following:
"Sep 16 13:22:11 'servername' authdaemond.plain: received auth request, service=imap, authtype=login
Sep 16 13:22:11 'servername' authdaemond.plain: authpam: trying this module
Sep 16 13:22:11 'servername' authdaemond.plain: authpam: sysusername='myusername', sysuserid=<null>, sysgroupid=1000, homedir=/home/'myhomedir', address='myusername', fullname='My Fullname,,,, maildir=<null>, quota=<null>, options=<null>
Sep 16 13:22:11 'servername' authdaemond.plain: authpam: clearpasswd=<null>, passwd=x
Sep 16 13:22:11 'servername' authdaemond.plain: pam_service=imap, pam_username='myusername'
Sep 16 13:22:11 'servername' authdaemond.plain: dopam successful
Sep 16 13:22:11 'servername' authdaemond.plain: authpam: ACCEPT, username 'myusername'
Sep 16 13:22:11 'servername' imaplogin: LOGIN: DEBUG: ip=[::ffff:192.168.x.x], command=LOGIN
Sep 16 13:22:11 'servername' imaplogin: LOGIN: DEBUG: ip=[::ffff:192.168.x.x], username='myusername'
Sep 16 13:22:11 'servername' imaplogin: LOGIN: DEBUG: ip=[::ffff:192.168.x.x], password='myusername'
Sep 16 13:22:11 'servername' imaplogin: authdaemon: starting client module
Sep 16 13:22:11 'servername' imaplogin: authdaemon: ACCEPT, username 'myusername'
Sep 16 13:22:11 'servername' imaplogin: LOGIN, user='myusername', ip=[::ffff:192.168.x.x], protocol=IMAP
Sep 16 15:37:30 'servername' imaplogin: Connection, ip=[::ffff:216.150.139.113] <-------????
That is: first me logging in from my normally used client, next what happen is this last line this "alien" connection.
Is this to say that "someone" is logging in and fetcing my mail?
Any suggestions would be welcome!


Reply With Quote