vpopmail.rst

Log Samples from vpopmail

Failed logins:

Sep 14 07:21:42 iron vpopmail[939]: vchkpw-pop3: password fail user1@xxxx.com:192.168.2.1
Sep 14 07:21:42 iron vpopmail[937]: vchkpw-pop3: password fail user2@xxxx.com:192.168.2.1
Sep 14 07:21:42 iron vpopmail[935]: vchkpw-pop3: password fail user3@xxxx.com:192.168.2.1
Jun 9 08:56:30 www vpopmail[65827]: vchkpw-smtp: password fail (pass: '<65825.1118321790@mail.xxx.com>') myuserid@xxx.com:208.210.222.68

Invalid user:

vpopmail[2100]: vchkpw-pop3: vpopmail user not found abc@xxx.com:x.x.x.x
vpopmail[65851]: vchkpw-pop3: vpopmail user not found myuserid@:208.210.222.68

Full samples:

Brute Force Attack:

Log samples from vpopmail and qmailtoaster

In qmailtoaster vpopmail can be use for: pop3, pop3s, imap, imaps, smtp, submission and webmail. Therefore each record can include respectively: * vchkpw-pop3: * vchkpw-pop3s: * vchkpw-imap: * vchkpw-imaps: * vchkpw-smtp: * vchkpw-submission: * vchkpw-webmail:

Succesfull login:

Bad password:

or if no password given:

Invalid user: