dovecot.log

[pandabb]

Hello i checked my dovecot log and to my surprise there are too many random login attempts, like more than 150+ with different usernames, is my system compromised or this is normal? can fail2ban ban the ip's below autpmatically.

Thanks!

an 18 00:09:45 auth: Error: passwd-file(laura,193.189.117.155): stat(/etc/exim/domains//passwd) failed: No such file or directory
Jan 18 00:10:13 auth: Error: passwd-file(master,193.189.117.148): stat(/etc/exim/domains//passwd) failed: No such file or directory
Jan 18 00:13:47 auth: Error: passwd-file(melissa,193.189.117.148): stat(/etc/exim/domains//passwd) failed: No such file or directory
Jan 18 00:13:51 auth: Error: passwd-file(library,193.189.117.155): stat(/etc/exim/domains//passwd) failed: No such file or directory

[BBuchanan1013]

Hello i checked my dovecot log and to my surprise there are too many random login attempts, like more than 150+ with different usernames, is my system compromised or this is normal? can fail2ban ban the ip's below autpmatically.

Thanks!

an 18 00:09:45 auth: Error: passwd-file(laura,193.189.117.155): stat(/etc/exim/domains//passwd) failed: No such file or directory
Jan 18 00:10:13 auth: Error: passwd-file(master,193.189.117.148): stat(/etc/exim/domains//passwd) failed: No such file or directory
Jan 18 00:13:47 auth: Error: passwd-file(melissa,193.189.117.148): stat(/etc/exim/domains//passwd) failed: No such file or directory
Jan 18 00:13:51 auth: Error: passwd-file(library,193.189.117.155): stat(/etc/exim/domains//passwd) failed: No such file or directory

If you think your system is compromised, then make sure you have a backup then just re-install everything. Though, if it were me, it actually looks like someone's attempting to make entry. Best bet is to add the ip to the firewall/fail2ban yourself and block it's access. I'm no expert, but it just looks like random attempts to gain access to your mail server and execute/view the passwd file (the one that has all users and passwords listed in it for the system, not for vesta specifically).

[pandabb]

thanks for the tip sir.

Does this mean bot is trying to login via domainname.com/webmail?

Is there anyway to change the alias /webmail or add some sort of .htaccess password to prevent bot from crawling it.

[pandabb]

Thanks for the help.

I decided just to remove my mail server since i really don't need it plus it takes so much ram if put it all together antiv etc.