Home / server / Questions / 156622
Accepted
etheros
Asked: 2010-07-02 02:54:11 +0800 CST

What is causing these strange mail logs?

  • 772

I was recently going over some old mail logs, and I came across this:

Jun 12 14:51:56 hostname imapd: LOGIN FAILED, user=Purple, ip=[::ffff:127.0.0.1]
Jun 12 14:51:56 hostname postfix/smtpd[21538]: disconnect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:51:58 hostname postfix/smtpd[21536]: connect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:02 hostname postfix/smtpd[21537]: disconnect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:03 hostname imapd: LOGIN FAILED, user=Sports, ip=[::ffff:127.0.0.1]
Jun 12 14:52:07 hostname postfix/smtpd[21559]: connect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:09 hostname postfix/smtpd[21536]: disconnect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:11 hostname imapd: LOGIN FAILED, user=dragon, ip=[::ffff:127.0.0.1]
Jun 12 14:52:14 hostname postfix/smtpd[21562]: connect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:17 hostname postfix/smtpd[21559]: disconnect from 75-145-26-162-Washington.hfc.comcastbusiness.net[75.145.26.162]
Jun 12 14:52:18 hostname imapd: LOGIN FAILED, user=michael, ip=[::ffff:127.0.0.1]

Why would courier-imapd be reporting login failures coming from 127.0.0.1?

Edit: While squirrelmail is installed, it's restricted to one IP address, and there are no logs indicating it has been accessed. Further, I'm the sole user of the machine so it's definitely not me. :-)

email log-files courier

5 Answers

  1. squirrel (or any other) webmail comes to my mind...

    • 1

  2. You probably have a webmail installed in the same server, so authentication are comming from localhost (127.0.0.1 is localhost)

    • 1

  3. As it has been mentioned, it would have to be something on the local machine connecting to the mail server via the local loopback (or using "localhost" as the server name).

    Most commonly, webmail, but could be anything which has the ability to talk across this "interface" .. Eg: if you were running any MUA on the machine it could be causing this behavior. Or alternatively, if you are running a web server and have code which uses php's imap_open() function and using "localhost" as the mail server name.. or (insert an other language which runs on the machine which could be doing this)

    • 0

  4. Check the web server logs at the same time of imapd fail login. So you can confirm or not the access is made by Squirrelmail and from where.

    • 0
  5. Best Answer

    I did some digging and it turns out that Postfix is using SASL for authentication, which is authenticating against the local courier-imapd - hence the logs.

    • 0