Aug 5, 2024: iRedMail-1.7.1 has been released.

**clarknova** · 2022-10-08 10:01:35

clarknova
Member
Offline

Registered: 2022-03-15
Posts: 20

Topic: reset bad roundcube and posfix configs

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.6.1
- Deployed with iRedMail Easy or the downloadable installer? downloadable
- Linux/BSD distribution name and version: Debian GNU/Linux 11.5 (bullseye)
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): Mariadb
- Web server (Apache or Nginx):nginx
- Manage mail accounts with iRedAdmin-Pro? no
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

I botched an upgrade and was disappointed to find my /etc/ directory is not backed up. I am able to check my mail through Thunderbird, however my Roundcube and postifx configs are borked.

Is there a documented process to reinstall these or reset their configs to a default working state without losing my existing users and mailboxes? My /var/vmail/ backups are intact, but that's all.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

**ZhangHuangbin** · 2022-10-08 17:16:57

ZhangHuangbin
iRedMail Developers
Offline

Registered: 2009-05-06
Posts: 31,082

Re: reset bad roundcube and posfix configs

- What do you mean "borked" here?
- What kind of upgrade did you do?

**clarknova** · 2022-10-08 20:39:03

clarknova
Member
Offline

Registered: 2022-03-15
Posts: 20

Re: reset bad roundcube and posfix configs

Roundcube: When I try to load the main page, I just see the attached screen.

postfix: I have recovered to the point I can now send mail through Thunderbird, but while the message appears to send fine, there is a delay of several minutes before it arrives in the recipients inbox. syslog looks like this:

root@mail:/etc/postfix# grep 4MkpYW5htyzDnJ /var/log/syslog
Oct  7 20:10:39 mail postfix/submission/smtpd[251866]: 4MkpYW5htyzDnJ: client=unknown[10.31.1.110], sasl_method=PLAIN, sasl_username=david@burgess.tech
Oct  7 20:10:39 mail postfix/cleanup[251871]: 4MkpYW5htyzDnJ: message-id=<7f74c904-7514-bde3-2ced-13df78760f24@burgess.tech>
Oct  7 20:10:39 mail postfix/qmgr[251674]: 4MkpYW5htyzDnJ: from=<david@burgess.tech>,size=765, nrcpt=1 (queue active)
Oct  7 20:10:39 mail postfix/amavis/smtp[251873]: 4MkpYW5htyzDnJ: to=<apt.get@gmail.com>, relay=127.0.0.1[127.0.0.1]:10026, delay=0.23, delays=0.13/0.05/0.01/0.04, dsn=4.3.2, status=deferred (host 127.0.0.1[127.0.0.1] said: 421 4.3.2 Service shutting down, closing channel (in reply to RCPT TO command))
Oct  7 20:17:29 mail postfix/qmgr[251674]: 4MkpYW5htyzDnJ: from=<david@burgess.tech>, size=765, nrcpt=1 (queue active)
Oct  7 20:17:29 mail postfix/amavis/smtp[252191]: 4MkpYW5htyzDnJ: to=<apt.get@gmail.com>, relay=127.0.0.1[127.0.0.1]:10026, delay=410, delays=410/0.08/0.01/0.05, dsn=4.3.2, status=deferred (host 127.0.0.1[127.0.0.1] said: 421 4.3.2 Service shutting down, closing channel (in reply to RCPT TO command))
Oct  7 20:27:29 mail postfix/qmgr[251674]: 4MkpYW5htyzDnJ: from=<david@burgess.tech>, size=765, nrcpt=1 (queue active)
Oct  7 20:27:30 mail amavis[252048]: (252048-01) Passed CLEAN {RelayedInternal}, ORIGINATING LOCAL [10.31.1.110]:43156 ESMTP/ESMTP <david@burgess.tech> -> <apt.get@gmail.com>, (), Queue-ID: 4MkpYW5htyzDnJ, Message-ID: <7f74c904-7514-bde3-2ced-13df78760f24@burgess.tech>, mail_id: z207tOAUelHa, b: EmqKUbnRu, Hits: -1, size: 765, queued_as: 4Mkpwy1P6SzDvj, Subject: "test2", From: <david@burgess.tech>, User-Agent: Mozilla/5.0_(X11;_Linux_x86_64;_rv:102.0)_Gecko/20100101_Thunderbird/102.3.0, helo=[10.31.1.110], Tests: [ALL_TRUSTED=-1], autolearn=ham autolearn_force=no, autolearnscore=0, dkim_new=dkim:burgess.tech, 893 ms
Oct  7 20:27:30 mail postfix/amavis/smtp[252584]: 4MkpYW5htyzDnJ: to=<apt.get@gmail.com>, relay=127.0.0.1[127.0.0.1]:10026, delay=1011, delays=1010/0.08/0.02/0.89, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 4Mkpwy1P6SzDvj 
Oct  7 20:27:30 mail postfix/qmgr[251674]: 4MkpYW5htyzDnJ: removed

I think the problems stemmed from me following the upgrade instructions for iredmail, then I got some errors resulting from the letsencrypt certs needing to be reinstalled, but I misdiagnosed it and started messing with the roundcube and postfix configs. Unfortunately I don't remember all the changes I made. I'm not sure which config I should post for roundcube, but my main.cf looks like this:

queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix/sbin
data_directory = /var/lib/postfix
mail_owner = postfix
sendmail_path = /usr/sbin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
debugger_command =
    PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
    ddd $daemon_directory/$process_name $process_id & sleep 5
debug_peer_level = 2
unknown_local_recipient_reject_code = 550
biff = no
swap_bangpath = no
allow_percent_hack = no
allow_min_user = no
disable_vrfy_command = yes
inet_protocols = all
inet_interfaces = all
smtpd_tls_key_file = /etc/letsencrypt/live/mail.burgess.tech/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.burgess.tech/fullchain.pem
smtpd_tls_CAfile = /etc/ssl/certs/iRedMail.crt
smtpd_tls_CApath = /etc/ssl/certs
smtpd_tls_protocols = !SSLv2 !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
smtp_tls_protocols = !SSLv2 !SSLv3
smtp_tls_mandatory_protocols = !SSLv2 !SSLv3
lmtp_tls_protocols = !SSLv2 !SSLv3
lmtp_tls_mandatory_protocols = !SSLv2 !SSLv3
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDC3-SHA, KRB5-DE5, CBC3-SHA
smtpd_tls_dh512_param_file = /etc/ssl/dh512_param.pem
smtpd_tls_dh1024_param_file = /etc/ssl/dh2048_param.pem
tls_random_source = dev:/dev/urandom
smtp_tls_loglevel = 1
smtpd_tls_loglevel = 1
smtpd_tls_security_level = may
smtp_tls_security_level = may
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_CAfile = $smtpd_tls_CAfile
smtp_tls_note_starttls_offer = yes
enable_long_queue_ids = yes
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = yes
header_checks = pcre:/etc/postfix/header_checks
body_checks = pcre:/etc/postfix/body_checks.pcre
smtpd_command_filter = pcre:/etc/postfix/command_filter.pcre
smtpd_helo_required = yes
smtpd_helo_restrictions =
    permit_mynetworks
    permit_sasl_authenticated
    check_helo_access pcre:/etc/postfix/helo_access.pcre
    reject_non_fqdn_helo_hostname
    reject_unknown_helo_hostname
smtpd_sender_restrictions =
    reject_non_fqdn_sender
    reject_unlisted_sender
    permit_mynetworks
    permit_sasl_authenticated
    check_sender_access pcre:/etc/postfix/sender_access.pcre
    reject_unknown_sender_domain
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_end_of_data_restrictions =
    check_policy_service inet:127.0.0.1:7777
smtpd_data_restrictions = reject_unauth_pipelining
proxy_read_maps = $canonical_maps $lmtp_generic_maps $local_recipient_maps $mydestination $mynetworks $recipient_bcc_maps $recipient_canonical_maps $relay_domains $relay_recipient_maps $relocated_maps $sender_bcc_maps $sender_canonical_maps $smtp_generic_maps $smtpd_sender_login_maps $transport_maps $virtual_alias_domains $virtual_alias_maps $virtual_mailbox_domains $virtual_mailbox_maps $smtpd_sender_restrictions $sender_dependent_relayhost_maps
enable_original_recipient = no
virtual_minimum_uid = 2000
virtual_uid_maps = static:2000
virtual_gid_maps = static:2000
virtual_mailbox_base = /var/vmail
virtual_alias_domains =
myhostname = mail.burgess.tech
myorigin = mail.burgess.tech
mydomain = mail.burgess.tech
mynetworks = [ '127.0.0.0/8', '172.30.0.0/22', 172.31.0.0/24', '104.37.148.71'] [::1]
mydestination = $myhostname, localhost, localhost.localdomain, mail.burgess.tech
alias_maps = hash:/etc/postfix/aliases
alias_database = hash:/etc/postfix/aliases
message_size_limit = 15728640
recipient_delimiter = +
show_user_unknown_table_name = no
compatibility_level = 2
transport_maps =
    proxy:mysql:/etc/postfix/mysql/transport_maps_user.cf
    proxy:mysql:/etc/postfix/mysql/transport_maps_maillist.cf
    proxy:mysql:/etc/postfix/mysql/transport_maps_domain.cf
sender_dependent_relayhost_maps =
    proxy:mysql:/etc/postfix/mysql/sender_dependent_relayhost_maps.cf
smtpd_sender_login_maps =
    proxy:mysql:/etc/postfix/mysql/sender_login_maps.cf
virtual_mailbox_domains =
    proxy:mysql:/etc/postfix/mysql/virtual_mailbox_domains.cf
relay_domains =
    $mydestination
    proxy:mysql:/etc/postfix/mysql/relay_domains.cf
virtual_mailbox_maps =
    proxy:mysql:/etc/postfix/mysql/virtual_mailbox_maps.cf
virtual_alias_maps =
    proxy:mysql:/etc/postfix/mysql/virtual_alias_maps.cf
    proxy:mysql:/etc/postfix/mysql/domain_alias_maps.cf
    proxy:mysql:/etc/postfix/mysql/catchall_maps.cf
    proxy:mysql:/etc/postfix/mysql/domain_alias_catchall_maps.cf
sender_bcc_maps =
    proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_user.cf
    proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_domain.cf
recipient_bcc_maps =
    proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_user.cf
    proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_domain.cf
postscreen_greet_action = drop
postscreen_blacklist_action = drop
postscreen_dnsbl_action = drop
postscreen_dnsbl_threshold = 2
postscreen_dnsbl_sites =
    zen.spamhaus.org=127.0.0.[2..11]*3
    b.barracudacentral.org=127.0.0.2*2
postscreen_dnsbl_reply_map = texthash:/etc/postfix/postscreen_dnsbl_reply
postscreen_access_list = permit_mynetworks cidr:/etc/postfix/postscreen_access.cidr
postscreen_dnsbl_whitelist_threshold = -2
smtpd_sasl_type = dovecot
smtpd_sasl_path = /var/spool/postfix/private/dovecot-auth
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
mlmmj_destination_recipient_limit = 1
content_filter = smtp-amavis:[127.0.0.1]:10024
smtp-amavis_destination_recipient_limit = 1
smtpd_sasl_local_domain = 
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_tls_received_header = yes

Post's attachments

error.png
error.png 19.46 kb, file has never been downloaded.

You don't have the permssions to download the attachments of this post.

**clarknova** · 2022-10-08 20:41:46

clarknova
Member
Offline

Registered: 2022-03-15
Posts: 20

Re: reset bad roundcube and posfix configs

I see this in /var/log/nginx/error.log after trying to load the web site:

2022/10/08 06:25:34 [error] 249625#249625: *13525 FastCGI sent in stderr: "PHP message: PHP Warning:  file_put_contents(/opt/www/roundcubemail-1.6.0/logs/errors.log): failed to open stream: Permission denied in /opt/www/roundcubemail-1.6.0/program/lib/Roundcube/rcube.php on line 1381PHP message: PHP Warning:  SQLSTATE[HY000] [1045] Access denied for user 'roundcube'@'localhost' (using password: NO) in /opt/www/roundcubemail-1.6.0/program/lib/Roundcube/rcube.php on line 1504" while reading response header from upstream, client: 104.37.148.71, server: mail.burgess.tech, request: "GET /mail/ HTTP/2.0", upstream: "fastcgi://127.0.0.1:9999", host: "mail.burgess.tech"

**ZhangHuangbin** · 2022-10-09 14:57:51

ZhangHuangbin
iRedMail Developers
Offline

Registered: 2009-05-06
Posts: 31,082

Re: reset bad roundcube and posfix configs

Roundcube is configured to log to syslog by iRedMail, not log to a file. In /opt/www/roundcubemail/config/config.inc.php:

$config['log_driver'] = 'syslog';
$config['syslog_facility'] = LOG_MAIL;
$config['log_logins'] = true;

**clarknova** · 2022-10-11 23:02:38

clarknova
Member
Offline

Registered: 2022-03-15
Posts: 20

Re: reset bad roundcube and posfix configs

Thanks for the pointer. I see that config.inc.php doesn't exist in that path for me, so I guess that points to part of my problem.

root@mail:~# ls -lh /opt/www/
total 16K
lrwxrwxrwx  1 root      root        15 Oct  3 07:58 iredadmin -> iRedAdmin-1.8.1
dr-xr-xr-x 12 iredadmin iredadmin 4.0K May  2 15:18 iRedAdmin-1.6
dr-xr-xr-x 12 iredadmin iredadmin 4.0K Oct  3 07:58 iRedAdmin-1.8.1
lrwxrwxrwx  1 root      root        29 Oct  3 16:34 roundcubemail -> /opt/www/roundcubemail-1.6.0/
drwxr-xr-x 13 root      root      4.0K Oct  3 09:00 roundcubemail-1.5.2
drwxr-xr-x 13       501        80 4.0K Oct  3 16:47 roundcubemail-1.6.0
root@mail:~# ls -lh /opt/www/roundcubemail-1.5.2/config/
total 92K
-rw------- 1 www-data www-data 7.1K Oct  3 09:02 config.inc.php
-rw------- 1 root     root     2.1K Mar 14  2022 config.inc.php.bak
-rw-r--r-- 1 root     root     4.1K Dec 29  2021 config.inc.php.sample
-rw-r--r-- 1 root     root     2.2K Oct  3 08:58 config.old.php
-rw-r--r-- 1      501       80  63K Jul 23 14:17 defaults.inc.php
-rw-r--r-- 1 root     root     2.8K Dec 29  2021 mimetypes.php
root@mail:~# ls -lh /opt/www/roundcubemail-1.6.0/config/
total 72K
-rw-r--r-- 1 501 80 2.9K Jul 23 14:17 config.inc.php.sample
-rw-r--r-- 1 501 80  63K Jul 23 14:17 defaults.inc.php
-rw-r--r-- 1 501 80 2.8K Jul 23 14:17 mimetypes.php

If I change the soft link to point to /opt/www/roundcubemail-1.5.2/ then I am able to load the web interface, log in and see my email. However when trying to send an email I get an overlaid error message in the bottom right corner of the screen "SMTP Error (): Authentication failed." I saw this same error in the past; I believe it was right after following the instructions to upgrade Roundcube to 1.6.0, and then while trying to resolve that error I make 1.6.0 into the broken state it's in now.

I don't remember everything I did, but I believe this is the portion of my bash history that lays bare my shame.

  379  cd /opt/www/
  380  ls -lh
  381  cd roundcubemail-1.6.0/
  382  ls -lh
  383  cd ..
  384  ls -lh
  385  rm roundcubemail
  386  ln -s /opt/www/roundcubemail-1.6.0/ roundcubemail
  387  ls -lh
  388  service roundcubemail restart
  389  cd roundcubemail
  390  ls
  391  bin/installto.sh /opt/www/roundcubemail-1.6.0/
  392  service nginx restart
  393  cd ../roundcubemail-1.6.0/
  394  bin/installto.sh /opt/www/roundcubemail-1.5.2/
  395  php composer.phar update --no-dev
  396  cd ..
  397  ls -lh
  398  fm roundcubemail
  399  ln -s /opt/www/roundcubemail-1.5.2/ roundcubemail
  400  cd roundcubemail-1.6.0/; bin/installto.sh /opt/www/roundcubemail-1.5.2/

**ZhangHuangbin** · 2022-10-13 13:58:32

ZhangHuangbin
iRedMail Developers
Offline

Registered: 2009-05-06
Posts: 31,082

Re: reset bad roundcube and posfix configs

Your upgrade was completely wrong. Besides, how can it be right if the config.inc.php file did not even exist ...

Try this:

- Backup /opt/www/roundcubemail-1.5.2/ first.
- Link /opt/www/roundcubemail back to /opt/www/roundcubemail-1.5.2/
- Download Roundcube 1.6.0 to /root/, uncompress it. So you get /root/roundcubemail-1.6.0.
- Upgrade it:

cd /root/roundcubemail-1.6.0
./bin/installto.sh /opt/www/roundcubemail/

**clarknova** · 2022-10-14 02:17:31

clarknova
Member
Offline

Registered: 2022-03-15
Posts: 20

Re: reset bad roundcube and posfix configs

Thank you. I obviously misunderstood the roundcube upgrade instructions.

I have followed your instructions exactly and now I can log into roundcube, but I don't know how to confirm which version I am running. The /opt/www/ directory looks the same as before, although the installto.sh script ran without error.

# ls -lh /opt/www/
total 16K
lrwxrwxrwx  1 root          root               15 Oct  3 07:58 iredadmin -> iRedAdmin-1.8.1
dr-xr-xr-x    12 iredadmin iredadmin 4.0K May  2 15:18 iRedAdmin-1.6
dr-xr-xr-x    12 iredadmin iredadmin 4.0K  Oct  3 07:58 iRedAdmin-1.8.1
lrwxrwxrwx  1 root          root              29 Oct 13 12:06 roundcubemail -> /opt/www/roundcubemail-1.5.2/
drwxr-xr-x  13 root      root      4.0K          Oct 13 12:10 roundcubemail-1.5.2
drwxr-xr-x  13 root      root      4.0K          Oct 13 12:05 roundcubemail-1.5.2.bak

I'm still getting "SMTP Error (): Authentication failed." when trying to send an email from roundcube.

**ZhangHuangbin** · 2022-10-15 14:55:46

ZhangHuangbin
iRedMail Developers
Offline

Registered: 2009-05-06
Posts: 31,082

Re: reset bad roundcube and posfix configs

clarknova wrote:

but I don't know how to confirm which version I am running.

Login to Rouncube webmail, click the "About" button/link.

clarknova wrote:

I'm still getting "SMTP Error (): Authentication failed." when trying to send an email from roundcube.

Few changes are required if you upgrade Roundcube to 1.6.0. https://forum.iredmail.org/post84373.html#p84373

**clarknova** · 2022-11-08 10:28:51

clarknova
Member
Offline

Registered: 2022-03-15
Posts: 20

Re: reset bad roundcube and posfix configs

Thank you! The SMTP error is gone and I can send mail through webmail again!

I also see that I am running Roundcube 1.6.0, but the folder appears in the filesystem as /opt/www/roundcubemail-1.5.2/. Is this expected?

**clarknova** · 2022-11-08 10:46:06

clarknova
Member
Offline

Registered: 2022-03-15
Posts: 20

Re: reset bad roundcube and posfix configs

Ok, it worked for a few minutes, now I get connection refused for both webmail and IMAP. I don't think I changed a thing since it was working.

oot@mail:~# netstat -lntp|grep '143\|443'
tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN      1583/dovecot        
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      1573/nginx: master  
tcp6       0      0 :::143                  :::*                    LISTEN      1583/dovecot        
tcp6       0      0 :::443                  :::*                    LISTEN      1573/nginx: master
root@mail:~# tcpdump -nienp2s0 host 142.59.108.61
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on enp2s0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
19:44:56.194457 IP 142.59.108.61.57102 > 172.31.0.25.443: Flags [S], seq 553224966, win 64240, options [mss 1460,sackOK,TS val 1061122411 ecr 0,nop,wscale 7], length 0
19:44:56.194555 IP 172.31.0.25 > 142.59.108.61: ICMP 172.31.0.25 tcp port 443 unreachable, length 68
19:44:56.210053 IP 142.59.108.61.57104 > 172.31.0.25.443: Flags [S], seq 4283862082, win 64240, options [mss 1460,sackOK,TS val 1061122427 ecr 0,nop,wscale 7], length 0
19:44:56.210100 IP 172.31.0.25 > 142.59.108.61: ICMP 172.31.0.25 tcp port 443 unreachable, length 68
19:44:58.398858 IP 142.59.108.61.52694 > 172.31.0.25.143: Flags [S], seq 1659069340, win 64240, options [mss 1460,sackOK,TS val 1061124616 ecr 0,nop,wscale 7], length 0
19:44:58.398935 IP 172.31.0.25 > 142.59.108.61: ICMP 172.31.0.25 tcp port 143 unreachable, length 68

**ZhangHuangbin** · 2022-11-08 11:28:30

ZhangHuangbin
iRedMail Developers
Offline

Registered: 2009-05-06
Posts: 31,082

Re: reset bad roundcube and posfix configs

clarknova wrote:

now I get connection refused for both webmail and IMAP.

Please check /var/log/dovecot/*.log for POP3/IMAP related errors.

**clarknova** · 2022-11-08 21:56:14

clarknova
Member
Offline

Registered: 2022-03-15
Posts: 20

Re: reset bad roundcube and posfix configs

It's working fine this morning. I don't know what changed.

/var/log/dovecot/dovecot.log:

Nov  7 19:27:04 mail dovecot: master: Warning: Killed with signal 15 (by pid=2083045 uid=0 code=kill)
Nov  7 19:27:05 mail dovecot: log(249601): Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
Nov  7 19:27:05 mail dovecot: master: Dovecot v2.3.13 (89f716dc2) starting up for pop3, imap, sieve, lmtp (core dumps disabled)
Nov  7 19:34:38 mail dovecot: master: Warning: Killed with signal 15 (by pid=2083704 uid=0 code=kill)
Nov  7 19:34:39 mail dovecot: log(2083052): Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
Nov  7 19:34:40 mail dovecot: master: Dovecot v2.3.13 (89f716dc2) starting up for pop3, imap, sieve, lmtp (core dumps disabled)
Nov  7 19:37:47 mail dovecot: master: Dovecot v2.3.13 (89f716dc2) starting up for pop3, imap, sieve, lmtp (core dumps disabled)
Nov  7 19:38:09 mail dovecot: stats: Error: conn stats-reader (127.0.0.1:55374): didn't reply with a valid VERSION line: EXPORT#011global
Nov  7 19:38:09 mail dovecot: stats: Error: conn stats-reader (127.0.0.1:55384): didn't reply with a valid VERSION line: EXPORT#011global
Nov  7 19:40:13 mail dovecot: master: Warning: Killed with signal 15 (by pid=1580 uid=0 code=kill)
Nov  7 19:40:14 mail dovecot: anvil: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
Nov  7 19:40:14 mail dovecot: stats: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
Nov  7 19:40:14 mail dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF
Nov  7 19:40:14 mail dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied
Nov  7 19:40:14 mail dovecot: auth: Error: net_connect_unix(/run/dovecot/stats-writer) failed: Permission denied
Nov  7 19:40:14 mail dovecot: auth: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
Nov  7 19:40:14 mail dovecot: log(484): Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
Nov  7 19:40:14 mail dovecot: log(484): Warning: Shutting down logging for 'auth: ' with 1 clients
Nov  7 19:40:14 mail dovecot: master: Dovecot v2.3.13 (89f716dc2) starting up for pop3, imap, sieve, lmtp (core dumps disabled)

Nothing in there from the past 12 hours almost.

/var/log/dovecot/imap.log:

Nov  7 19:12:25 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2082306, secured, session=<pgg1EuzsmNsAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:12:25 mail dovecot: imap(david@burgess.tech)<2082306><pgg1EuzsmNsAAAAAAAAAAAAAAAAAAAAB>: Logged out in=82 out=903 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:12:25 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2082311, secured, session=<NPc4EuzsoNsAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:12:25 mail dovecot: imap(david@burgess.tech)<2082311><NPc4EuzsoNsAAAAAAAAAAAAAAAAAAAAB>: Logged out in=70 out=1019 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:12:26 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2082315, secured, session=<V55FEuzsrNsAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:12:26 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2082317, secured, session=<//dGEuzsvNsAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:12:26 mail dovecot: imap(david@burgess.tech)<2082317><//dGEuzsvNsAAAAAAAAAAAAAAAAAAAAB>: Logged out in=478 out=1883 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:12:26 mail dovecot: imap(david@burgess.tech)<2082315><V55FEuzsrNsAAAAAAAAAAAAAAAAAAAAB>: Logged out in=604 out=34511 deleted=0 expunged=0 trashed=0 hdr_count=60 hdr_bytes=19033 body_count=0 body_bytes=0
Nov  7 19:13:29 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, secured, session=<4w7hFezsDo8AAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:13:45 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, secured, session=<fYKYFuzs9N4AAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:13:47 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, secured, session=<MxX+Fuzs+N4AAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:13:47 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, secured, session=<YHr+FuzsAt8AAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:13:53 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2082363, secured, session=<9x1wF+zsas8AAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:13:53 mail dovecot: imap(david@burgess.tech)<2082363><9x1wF+zsas8AAAAAAAAAAAAAAAAAAAAB>: Logged out in=82 out=903 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:13:53 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2082366, secured, session=<iIJyF+zscM8AAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:13:53 mail dovecot: imap(david@burgess.tech)<2082366><iIJyF+zscM8AAAAAAAAAAAAAAAAAAAAB>: Logged out in=70 out=1019 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:13:54 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2082369, secured, session=<qxd9F+zsgM8AAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:13:54 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2082370, secured, session=<O519F+zshM8AAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:13:54 mail dovecot: imap(david@burgess.tech)<2082370><O519F+zshM8AAAAAAAAAAAAAAAAAAAAB>: Logged out in=478 out=1883 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:13:54 mail dovecot: imap(david@burgess.tech)<2082369><qxd9F+zsgM8AAAAAAAAAAAAAAAAAAAAB>: Logged out in=604 out=34511 deleted=0 expunged=0 trashed=0 hdr_count=60 hdr_bytes=19033 body_count=0 body_bytes=0
Nov  7 19:14:54 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2082408, secured, session=<RG8QG+zsSLkAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:14:54 mail dovecot: imap(david@burgess.tech)<2082408><RG8QG+zsSLkAAAAAAAAAAAAAAAAAAAAB>: Logged out in=756 out=5329 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:15:54 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2082442, secured, session=<0eujHuzsJoAAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:15:54 mail dovecot: imap(david@burgess.tech)<2082442><0eujHuzsJoAAAAAAAAAAAAAAAAAAAAAB>: Logged out in=756 out=5265 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:16:30 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2082482, secured, session=<o3HKIOzsnIkAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:16:30 mail dovecot: imap(david@burgess.tech)<2082482><o3HKIOzsnIkAAAAAAAAAAAAAAAAAAAAB>: Logged out in=32 out=582 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:16:30 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2082484, secured, session=<I+PMIOzsqIkAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:16:30 mail dovecot: imap(david@burgess.tech)<2082484><I+PMIOzsqIkAAAAAAAAAAAAAAAAAAAAB>: Logged out in=44 out=893 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:27:04 mail dovecot: imap(david@burgess.tech)<2081684><cqfg4+vsLNyOO2w9>: Server shutting down. in=1441 out=11488 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=431 body_count=0 body_bytes=0
Nov  7 19:27:04 mail dovecot: imap(david@burgess.tech)<2080698><Y7o8ievsppKOO2w9>: Server shutting down. in=3016 out=16477 deleted=0 expunged=0 trashed=1 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:27:20 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2083352, secured, session=<U0iKR+zswMoAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:27:20 mail dovecot: imap(david@burgess.tech)<2083352><U0iKR+zswMoAAAAAAAAAAAAAAAAAAAAB>: Logged out in=333 out=763 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:27:21 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2083360, secured, session=<UpSYR+zsxMoAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:27:21 mail dovecot: imap(david@burgess.tech)<2083360><UpSYR+zsxMoAAAAAAAAAAAAAAAAAAAAB>: Logged out in=70 out=1019 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:27:21 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2083365, secured, session=<aCakR+zszsoAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:27:21 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2083366, secured, session=<0pykR+zs1MoAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:27:22 mail dovecot: imap(david@burgess.tech)<2083366><0pykR+zs1MoAAAAAAAAAAAAAAAAAAAAB>: Logged out in=478 out=1891 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:27:22 mail dovecot: imap(david@burgess.tech)<2083365><aCakR+zszsoAAAAAAAAAAAAAAAAAAAAB>: Logged out in=604 out=34511 deleted=0 expunged=0 trashed=0 hdr_count=60 hdr_bytes=19033 body_count=0 body_bytes=0
Nov  7 19:28:22 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2083410, secured, session=<ryA7S+zsQIoAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:28:22 mail dovecot: imap(david@burgess.tech)<2083410><ryA7S+zsQIoAAAAAAAAAAAAAAAAAAAAB>: Logged out in=756 out=5337 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:29:22 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2083445, secured, session=<KIjPTuzsXOAAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:29:22 mail dovecot: imap(david@burgess.tech)<2083445><KIjPTuzsXOAAAAAAAAAAAAAAAAAAAAAB>: Logged out in=756 out=5337 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:30:22 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2083496, secured, session=<RH5sUuzs8LYAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:30:23 mail dovecot: imap(david@burgess.tech)<2083496><RH5sUuzs8LYAAAAAAAAAAAAAAAAAAAAB>: Logged out in=1254 out=38294 deleted=0 expunged=0 trashed=0 hdr_count=60 hdr_bytes=18999 body_count=0 body_bytes=0
Nov  7 19:30:37 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2083501, secured, session=<pcpLU+zsyrwAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:30:37 mail dovecot: imap(david@burgess.tech)<2083501><pcpLU+zsyrwAAAAAAAAAAAAAAAAAAAAB>: Logged out in=480 out=5408 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=468 body_count=1 body_bytes=2740
Nov  7 19:30:40 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2083503, secured, session=<GBl+U+zs1rwAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:30:40 mail dovecot: imap(david@burgess.tech)<2083503><GBl+U+zs1rwAAAAAAAAAAAAAAAAAAAAB>: Logged out in=436 out=35708 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=468 body_count=1 body_bytes=33122
Nov  7 19:30:46 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2083506, secured, session=<AtfQU+zs5rwAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:30:46 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2083509, secured, session=<YfbRU+zs8rwAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:30:46 mail dovecot: imap(david@burgess.tech)<2083506><AtfQU+zs5rwAAAAAAAAAAAAAAAAAAAAB>: copy from INBOX: box=Trash, uid=3469, msgid=<1949015019.883175.1667874551790@lor1-app54189.prod.linkedin.com>, size=42436, from=LinkedIn <updates-noreply@linkedin.com>, subject=Tom Pope from a company you follow recently posted this, flags=(\Seen)
Nov  7 19:30:46 mail dovecot: imap(david@burgess.tech)<2083506><AtfQU+zs5rwAAAAAAAAAAAAAAAAAAAAB>: expunge: box=INBOX, uid=3589, msgid=<1949015019.883175.1667874551790@lor1-app54189.prod.linkedin.com>, size=42436, from=LinkedIn <updates-noreply@linkedin.com>, subject=Tom Pope from a company you follow recently posted this, flags=(\Seen)
Nov  7 19:30:46 mail dovecot: imap(david@burgess.tech)<2083509><YfbRU+zs8rwAAAAAAAAAAAAAAAAAAAAB>: Logged out in=436 out=3029 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=406 body_count=1 body_bytes=448
Nov  7 19:30:46 mail dovecot: imap(david@burgess.tech)<2083506><AtfQU+zs5rwAAAAAAAAAAAAAAAAAAAAB>: Logged out in=500 out=3233 deleted=0 expunged=0 trashed=1 hdr_count=1 hdr_bytes=328 body_count=0 body_bytes=0
Nov  7 19:31:21 mail dovecot: imap-login: Disconnected (auth failed, 3 attempts in 14 secs): user=<david@burgess.tech>, method=PLAIN, rip=142.59.108.61, lip=172.31.0.25, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<UJ0WVezsypOOO2w9>
Nov  7 19:31:22 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=::1, lip=::1, mpid=2083541, secured, session=<Ng0AVuzsSpcAAAAAAAAAAAAAAAAAAAAB>
Nov  7 19:31:22 mail dovecot: imap(david@burgess.tech)<2083541><Ng0AVuzsSpcAAAAAAAAAAAAAAAAAAAAB>: Logged out in=1077 out=5341 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  7 19:31:31 mail dovecot: imap-login: Disconnected (auth failed, 3 attempts in 10 secs): user=<david@burgess.tech>, method=PLAIN, rip=142.59.108.61, lip=172.31.0.25, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<v3TsVezs2IWOO2w9>
Nov  7 19:31:37 mail dovecot: imap-login: Disconnected (auth failed, 3 attempts in 6 secs): user=<david@burgess.tech>, method=PLAIN, rip=142.59.108.61, lip=172.31.0.25, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<viWFVuzsCLaOO2w9>
Nov  7 19:31:43 mail dovecot: imap-login: Disconnected (auth failed, 3 attempts in 6 secs): user=<david@burgess.tech>, method=PLAIN, rip=142.59.108.61, lip=172.31.0.25, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<y//gVuzsFraOO2w9>
Nov  7 19:31:49 mail dovecot: imap-login: Disconnected (auth failed, 3 attempts in 6 secs): user=<david@burgess.tech>, method=PLAIN, rip=142.59.108.61, lip=172.31.0.25, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<TLI8V+zsKMeOO2w9>
Nov  7 19:34:39 mail dovecot: log(2083052): Warning: Shutting down logging for 'imap-login: ' with 1 clients
Nov  7 21:04:54 mail dovecot: imap-login: Aborted login (no auth attempts in 4 secs): user=<>, rip=87.236.176.39, lip=172.31.0.25, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<+GKBpO3ss4JX7LAn>
Nov  8 00:19:22 mail dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=104.152.52.89, lip=172.31.0.25, session=<7bvwW/Ds38pomDRZ>
Nov  8 01:25:55 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<988455@77batch.top>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<J8rXSfHsxMR/AAAB>
Nov  8 01:27:00 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<988455@77batch.top>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=</oSvTfHs/IN/AAAB>
Nov  8 01:27:38 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<988455@77batch.top>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<wRP0T/HsAOV/AAAB>
Nov  8 04:53:40 mail dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=193.118.53.210, lip=172.31.0.25, session=<p1nnMPTsdMfBdjXS>
Nov  8 06:35:46 mail dovecot: imap-login: Disconnected (auth failed, 3 attempts in 6 secs): user=<david@burgess.tech>, method=PLAIN, rip=142.59.108.61, lip=172.31.0.25, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<44eznfXsTr2OO2w9>
Nov  8 06:35:46 mail dovecot: imap-login: Disconnected (auth failed, 3 attempts in 6 secs): user=<david@burgess.tech>, method=PLAIN, rip=142.59.108.61, lip=172.31.0.25, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<h6CznfXsXL2OO2w9>
Nov  8 06:37:58 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31387, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<MXTlpfXsHLd/AAAB>
Nov  8 06:37:58 mail dovecot: imap(david@burgess.tech)<31387><MXTlpfXsHLd/AAAB>: Logged out in=82 out=903 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:37:58 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31391, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<M9fspfXsJrd/AAAB>
Nov  8 06:37:58 mail dovecot: imap(david@burgess.tech)<31391><M9fspfXsJrd/AAAB>: Logged out in=70 out=1019 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:38:00 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31396, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<McEKpvXsLrd/AAAB>
Nov  8 06:38:00 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31397, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<fyULpvXsMLd/AAAB>
Nov  8 06:38:00 mail dovecot: imap(david@burgess.tech)<31397><fyULpvXsMLd/AAAB>: Logged out in=478 out=1883 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:38:00 mail dovecot: imap(david@burgess.tech)<31396><McEKpvXsLrd/AAAB>: Logged out in=594 out=34545 deleted=0 expunged=0 trashed=0 hdr_count=60 hdr_bytes=19005 body_count=0 body_bytes=0
Nov  8 06:39:00 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31429, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<eZedqfXsnMV/AAAB>
Nov  8 06:39:00 mail dovecot: imap(david@burgess.tech)<31429><eZedqfXsnMV/AAAB>: Logged out in=756 out=5401 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:40:00 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31533, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<jtYxrfXsVId/AAAB>
Nov  8 06:40:00 mail dovecot: imap(david@burgess.tech)<31533><jtYxrfXsVId/AAAB>: Logged out in=756 out=5401 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:41:00 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31574, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<5gfGsPXsAIZ/AAAB>
Nov  8 06:41:00 mail dovecot: imap(david@burgess.tech)<31574><5gfGsPXsAIZ/AAAB>: Logged out in=756 out=5393 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:42:00 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31606, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<u5tatPXsqr1/AAAB>
Nov  8 06:42:00 mail dovecot: imap(david@burgess.tech)<31606><u5tatPXsqr1/AAAB>: Logged out in=756 out=5401 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:43:00 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31653, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<LX/ut/XsJJd/AAAB>
Nov  8 06:43:00 mail dovecot: imap(david@burgess.tech)<31653><LX/ut/XsJJd/AAAB>: Logged out in=756 out=5377 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:44:00 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31685, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<E+OCu/XsxMt/AAAB>
Nov  8 06:44:00 mail dovecot: imap(david@burgess.tech)<31685><E+OCu/XsxMt/AAAB>: Logged out in=756 out=5401 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:45:00 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31726, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<TV4Xv/XssOt/AAAB>
Nov  8 06:45:00 mail dovecot: imap(david@burgess.tech)<31726><TV4Xv/XssOt/AAAB>: Logged out in=756 out=5329 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:45:50 mail dovecot: imap-login: Disconnected (auth failed, 3 attempts in 14 secs): user=<david@burgess.tech>, method=PLAIN, rip=142.59.108.61, lip=172.31.0.25, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<o383wfXsUp6OO2w9>
Nov  8 06:46:00 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31759, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<wrmrwvXscJV/AAAB>
Nov  8 06:46:00 mail dovecot: imap(david@burgess.tech)<31759><wrmrwvXscJV/AAAB>: Logged out in=756 out=5401 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:46:45 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31790, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<5SZexfXs3pZ/AAAB>
Nov  8 06:46:46 mail dovecot: imap(david@burgess.tech)<31790><5SZexfXs3pZ/AAAB>: Logged out in=480 out=3233 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=415 body_count=1 body_bytes=811
Nov  8 06:47:01 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31822, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<REFJxvXsTrl/AAAB>
Nov  8 06:47:01 mail dovecot: imap(david@burgess.tech)<31822><REFJxvXsTrl/AAAB>: Logged out in=1067 out=5537 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:48:01 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31885, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<LtfgyfXskLl/AAAB>
Nov  8 06:48:01 mail dovecot: imap(david@burgess.tech)<31885><LtfgyfXskLl/AAAB>: Logged out in=756 out=5401 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:49:01 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31925, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<GKR1zfXscMd/AAAB>
Nov  8 06:49:01 mail dovecot: imap(david@burgess.tech)<31925><GKR1zfXscMd/AAAB>: Logged out in=756 out=5401 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:49:33 mail dovecot: imap-login: Disconnected (auth failed, 3 attempts in 14 secs): user=<david@burgess.tech>, method=PLAIN, rip=142.59.108.61, lip=172.31.0.25, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<yruLzvXscN+OO2w9>
Nov  8 06:50:01 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31955, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<9IwI0fXsDJ9/AAAB>
Nov  8 06:50:01 mail dovecot: imap(david@burgess.tech)<31955><9IwI0fXsDJ9/AAAB>: Logged out in=756 out=5353 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:50:02 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=PLAIN, rip=142.59.108.61, lip=172.31.0.25, mpid=31980, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<sQ5Vz/XsbImOO2w9>
Nov  8 06:50:11 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31984, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<wqud0fXsOJZ/AAAB>
Nov  8 06:50:11 mail dovecot: imap(david@burgess.tech)<31984><wqud0fXsOJZ/AAAB>: Logged out in=480 out=3102 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=397 body_count=1 body_bytes=467
Nov  8 06:50:16 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=PLAIN, rip=142.59.108.61, lip=172.31.0.25, mpid=31986, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<Aa/t0fXs1tyOO2w9>
Nov  8 06:50:18 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31988, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<Rq8D0vXsQpZ/AAAB>
Nov  8 06:50:18 mail dovecot: imap(david@burgess.tech)<31988><Rq8D0vXsQpZ/AAAB>: Logged out in=32 out=582 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:50:18 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=31990, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<n/QH0vXsUpZ/AAAB>
Nov  8 06:50:18 mail dovecot: imap(david@burgess.tech)<31990><n/QH0vXsUpZ/AAAB>: Logged out in=436 out=3052 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=397 body_count=1 body_bytes=467
Nov  8 06:50:26 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=32003, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<TvyE0vXswKN/AAAB>
Nov  8 06:50:26 mail dovecot: imap(david@burgess.tech)<32003><TvyE0vXswKN/AAAB>: Logged out in=1354 out=1268 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:50:27 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=32010, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<axWY0vXs0KN/AAAB>
Nov  8 06:50:27 mail dovecot: imap(david@burgess.tech)<32010><axWY0vXs0KN/AAAB>: Logged out in=70 out=1019 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:50:29 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=32014, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<oly30vXs0qN/AAAB>
Nov  8 06:50:29 mail dovecot: imap-login: Login: user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=32016, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<t8e30vXs4KN/AAAB>
Nov  8 06:50:30 mail dovecot: imap(david@burgess.tech)<32016><t8e30vXs4KN/AAAB>: Logged out in=478 out=1891 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Nov  8 06:50:30 mail dovecot: imap(david@burgess.tech)<32014><oly30vXs0qN/AAAB>: Logged out in=594 out=34563 deleted=0 expunged=0 trashed=0 hdr_count=60 hdr_bytes=19005 body_count=0 body_bytes=0

sieve.log is empty and lda.log just shows a bunch of normal email traffic.

**clarknova** · 2022-11-13 00:39:30

clarknova
Member
Offline

Registered: 2022-03-15
Posts: 20

Re: reset bad roundcube and posfix configs

This morning I changed my user password twice in iredadm due to an unrelated problem with iphone. After changing the password the first time, no problem. I was able to log into web mail with the new password.

After changing the password the second time, I am seeing the same problem I posted about on the 7th, wwith tcpdump on the server is showing "ICMP 172.31.0.25 tcp port xxx unreachable" while trying to load the web mail page or check messages in Thunderbird.

Again, the only log showing errors is imap.log, but they don't appear to be closely correlated with the connection attempts.

root@mail:/var/log/dovecot# tail imap.log
Nov 12 09:04:54 mail dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=142.59.108.61, lip=172.31.0.25, session=<J0LLKkjtrOaOO2w9>
Nov 12 09:04:55 mail dovecot: imap-login: Aborted login (no auth attempts in 1 secs): user=<>, rip=142.59.108.61, lip=172.31.0.25, session=<u2/MKkjtruaOO2w9>
Nov 12 09:04:55 mail dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=142.59.108.61, lip=172.31.0.25, session=<1cbMKkjtr+aOO2w9>
Nov 12 09:05:00 mail dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=142.59.108.61, lip=172.31.0.25, session=<9FcaK0jtsuaOO2w9>
Nov 12 09:05:00 mail dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=142.59.108.61, lip=172.31.0.25, session=<5YgbK0jts+aOO2w9>
Nov 12 09:05:00 mail dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=142.59.108.61, lip=172.31.0.25, session=<IvAbK0jttOaOO2w9>
Nov 12 09:08:08 mail dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=142.59.108.61, lip=172.31.0.25, session=<77pbNkjt2+aOO2w9>
Nov 12 09:16:04 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<B+yWUkjtSK1/AAAB>
Nov 12 09:16:13 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<UMLhUkjtWK1/AAAB>
Nov 12 09:16:19 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<david@burgess.tech>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<qbB3U0jtFOd/AAAB>

**Cthulhu** · 2022-11-13 10:29:49

Cthulhu
Member
Offline

Registered: 2019-06-04
Posts: 907

Re: reset bad roundcube and posfix configs

IP is banned by fail2ban due to failed login attempts

Aug 5, 2024: iRedMail-1.7.1 has been released.

reset bad roundcube and posfix configs

Posts: 15

1 Topic by clarknova 2022-10-08 10:01:35 (edited by clarknova 2022-10-08 10:02:02)

Topic: reset bad roundcube and posfix configs

2 Reply by ZhangHuangbin 2022-10-08 17:16:57

Re: reset bad roundcube and posfix configs

3 Reply by clarknova 2022-10-08 20:39:03

Re: reset bad roundcube and posfix configs

4 Reply by clarknova 2022-10-08 20:41:46

Re: reset bad roundcube and posfix configs

5 Reply by ZhangHuangbin 2022-10-09 14:57:51

Re: reset bad roundcube and posfix configs

6 Reply by clarknova 2022-10-11 23:02:38

Re: reset bad roundcube and posfix configs

7 Reply by ZhangHuangbin 2022-10-13 13:58:32

Re: reset bad roundcube and posfix configs

8 Reply by clarknova 2022-10-14 02:17:31

Re: reset bad roundcube and posfix configs

9 Reply by ZhangHuangbin 2022-10-15 14:55:46

Re: reset bad roundcube and posfix configs

10 Reply by clarknova 2022-11-08 10:28:51

Re: reset bad roundcube and posfix configs

11 Reply by clarknova 2022-11-08 10:46:06

Re: reset bad roundcube and posfix configs

12 Reply by ZhangHuangbin 2022-11-08 11:28:30

Re: reset bad roundcube and posfix configs

13 Reply by clarknova 2022-11-08 21:56:14

Re: reset bad roundcube and posfix configs

14 Reply by clarknova 2022-11-13 00:39:30 (edited by clarknova 2022-11-13 00:40:39)

Re: reset bad roundcube and posfix configs

15 Reply by Cthulhu 2022-11-13 10:29:49

Re: reset bad roundcube and posfix configs

Posts: 15