login failed when try to connect to mail server
 

hi guys,

recently we had a problem for some of our users, they claim that they cannot login to our mail server either using outlook express/thunderbird or using our squirrelmail. we are using sendmail-8.12.8-9.90 on redhat 9 (dell 2650), imap-2004c1(washington imap). i check the logs and found this:

Apr 7 08:59:00 act-naim ipop3d[21657]: Logout user= host=
Apr 7 09:03:54 act-naim pop(pam_unix)[25263]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=
Apr 7 09:03:57 act-naim ipop3d[25263]: Login failed user= auth =host=
Apr 7 09:04:00 act-naim ipop3d[25263]: Logout user=host=
Apr 7 09:05:11 act-naim imap(pam_unix)[25326]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=
Apr 7 09:05:13 act-naim imapd[25326]: Login failed user=auth=host=
Apr 7 09:05:16 act-naim imapd[25326]: Command stream end of file, while reading line user= host=
Apr 7 09:07:43 act-naim sshd(pam_unix)[25470]: session opened for user root by (uid=0)
Apr 7 09:08:54 act-naim pop(pam_unix)[25566]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.24.1.60 user=
Apr 7 09:08:57 act-naim ipop3d[25566]: Login failed user=auth=host=
Apr 7 09:09:00 act-naim ipop3d[25566]: Logout user=host=

fyi, we had migrate from our solaris to linux 3 weeks ago. i just copied passwd and shadow and it works...unfortunately this weeks i has received many calls from our users, they claim they cannot connect (unknown user/password incorrect). they try many times before they can connect to our mail server.
is there any problem with the PAM or our imap connection is not stable? please help...

Hard to say exactly what's going on based on the info you provided. Does the problem only occur with a certain group of users, or are all users affected? Could authentication be failing because the system is overloaded? I don't really know much about the UW IMAP and POP3 daemons. You might consider switched to Courier or (my personal favorite) Dovecot which have more features.

[edited to add...]

It seems odd that all the user= and host= lines are blank in your log messages. Have you tried telneting to ports 110 and 143 and issued POP/IMAP commands yourself to see exactly what's going on? It's really odd that authentication fails most of the time but works on occassion.

i do not know whether my PAM or my imap connection is the problem...it's happen to some of my users, not all..i'll try to telnet to my server using imap/pop using my name and i's ok, today i will contact some users who had that problem...i'll paste the log again..

Apr 8 08:08:24 act-naim imapd[32550]: Command stream end of file, while reading line user=muzzafar host=wmail1.iiu.edu.my [10.1.2.143]
Apr 8 08:08:58 act-naim pop(pam_unix)[32578]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.24.1.60 user=shareen
Apr 8 08:09:00 act-naim ipop3d[32578]: Login failed user=shareen auth=shareen host=[10.24.1.60]
Apr 8 08:09:03 act-naim ipop3d[32578]: Logout user=shareen host=[10.24.1.60]
Apr 8 08:09:19 act-naim imap(pam_unix)[32595]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.1.2.143 user=muzzafar
Apr 8 08:09:22 act-naim imapd[32595]: Login failed user=muzzafar auth=muzzafar host=wmail1.iiu.edu.my [10.1.2.143]
Apr 8 08:09:25 act-naim imapd[32595]: Command stream end of file, while reading line user=muzzafar host=wmail1.iiu.edu.my [10.1.2.143]
Apr 8 08:09:36 act-naim imapd[32609]: Login failed user=muzzafar auth=muzzafar host=wmail1.iiu.edu.my [10.1.2.143]
Apr 8 08:09:39 act-naim imapd[32609]: Command stream end of file, while reading line user=muzzafar host=wmail1.iiu.edu.my [10.1.2.143]
Apr 8 08:13:58 act-naim pop(pam_unix)[399]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.24.1.60 user=shareen
Apr 8 08:14:00 act-naim ipop3d[399]: Login failed user=shareen auth=shareen host=[10.24.1.60]
Apr 8 08:14:03 act-naim ipop3d[399]: Logout user=shareen host=[10.24.1.60]

The command stream end of file is rather interesting. You should try to determine if all of the failing users are using the same mail client. Several mail clients have known bugs and this may be part of the problem. Googling on that may help too.

Good luck.

if you look at that following ip, 10.1.2.143 and 10.1.2.141 is using squirrelmail and the rest is using either outlook express or mozilla thunderbird. it quite annoyying until now i can not slove this problem. any ideas?