IMAP POP3 issue for login webmail accounts in outlook

hi, I am only a novice when it comes to webserver/email security. I have been experiencing these kinds of entries in my server logs for email as well.

Now my understanding is that what one needs to do in order to at least look after your server, is check to see if fail2ban is running on your system Webmin>Servers>fail2ban and, that it is correctly configured to monitor hacking attempts.

If not, install and activate "fail2ban" in virtualmin.

One you have done that, then the following resources may help get started

Please note that you wont suddenly see a complete stop of all the above entries in server logs or mail logs or fail2ban logs, the idea is, that fail2ban monitors the incoming hacking attempts against the various log files you configure it to use, and if a suspicious user is constantly trying to break in, it will ban their ip address for a given period of time and store this information in a log file for future reference.

As a final thought...someone once mentioned to me on a forum, that in maintaining a webserver, they essentially live on the server log files...ie eat, sleep, and drink server logs. Now that i am venturing into fail2ban, i have found myself consumed with this very issue that you have asked about with this thread here.

Now one very very important thing to remember... https://blog.rimuhosting.com/2017/02/24/whitelist-your-own-computer-in-fail2ban/

And...just in case you lock yourself out of webserver

the ipaddress is the ip of your home/work internet gateway usually. So if your internet service provider has given you a static home or office ip address, that would be the ipaddress you use.

A simple and easy way of finding out what your home/office public ip address is, can be done simply by navigating to the following URL and it will display your ip address on screen. https://www.hashemian.com/whoami/

Good luck with it.

Howdy,

Which webmail client is it that you were able to log in as -- was it by chance Usermin?

Also, if you look in Edit Users in Virtualmin, and look at the "Login" column, is the login name listed there what you're using to log in with Outlook?

-Eric

Howdy,

Usermin is particularly forgiving with the username you can use to log in... it will allow you to use the real system username, along with any email addresses or aliases associated with that user.

Other clients don't work that way though -- a client like Outlook, Thunderbird, or even RoundCube will authenticate with Dovecot using IMAP, and Dovecot will strictly require the actual username.

So if the username on your server is just "amrit", you would need to use "amrit" in Outlook... you wouldn't be able to use the full email address in that case.

-Eric

for someone who is manually trying to login...that is an awful lot of tries in a short period of time. Is this your server you are trying to log into or someone elses? Something seems suspicious here

Hmm, it looks like something may be awry with the Dovecot configuration there. This is an unusual error message:

Invalid password in passdb: crypt() failed: Invalid argument

Can you run the command "dovecot -n", and paste in the output?

Also, what distro/version is this?

-Eric