Configure qmail and Courier-IMAP to log incorrect passwords

Cidi Rome · 06-28-2014, 10:42 AM

Hi.

Does any of you know if it is possible to configure qmail and Courier-IMAP to log the incorrect passwords that are tried.

I'm referring to the password itself, not the fact that an incorrect password has been tried.

Best Regards.

bathory · 06-28-2014, 12:38 PM

Quote:

Originally Posted by Cidi Rome

Hi.

Does any of you know if it is possible to configure qmail and Courier-IMAP to log the incorrect passwords that are tried.

I'm referring to the password itself, not the fact that an incorrect password has me tried.

Best Regards.

If you're using authlib, you can set

Code:

DEBUG_LOGIN=2

in authdaemonrc. Read the info included in that file to see what modifications (if any) you have to do in /etc/rsyslogd.conf in order use the debug level in logs.

Regards

Cidi Rome · 06-28-2014, 01:07 PM

I'm using syslog-ng but I would think this king a configuration would be made in the server itself not the logging system...

I guess I was wrong...

Thank you for your reply, I will analyse.

Update:
I managed to find what I wanted, but I can see all the passwords, I would be nice to only check the wrong ones.
/etc/courier-imap/authlib/authdaemonrc

I gess I will only activate de DEBUG LEVEL 2 when I see brute force attacks and want to investigate.

Once again, thank you