connection dropped by imap server

[associates]

Hi,

I got the following error message when trying to login this morning.

Error: Connection dropped by imap server

This error comes from Squirrelmail as my Webmail client and hMailServer 5.1.1 B341.

I have never had this error before since the day i started to use hMailServer and Squirrelmail. The problem occurred for about half an hour and then went away by itself. Having said that, i did re-start the computer (runs on XP Pro SP3) in a hope that it would resolve itself but it did not. I kept trying and trying and then all of a sudden, it then worked again (very odd).

When the problem persisted, i went to check the log file under hMailServer. Below was what i saw.

Authentication failed. Restarting authentication process
RSET
OK
AUTH LOGIN
...

Authentication failed. Restarting authentication process
...

Authentication failed. Too many invalid logon attempts
...

Any helps would be greatly appreciated.

Thank you in advance

[mattg]

check your IP ranges.

I'd guess that you have Auto-ban enabled and didn't raise the priority of the IP range where your Squirrelmail is hosted (probably my computer) above 20

[associates]

Thank you Mattg for your reply.

Yes, i have the auto-ban enabled. I would probably leave it enabled for now. In IP-range setting, i have my computer set with priority of 15 and Internet with 10 (very odd. my computer has a higher priority than Internet?). Anyway, I have changed the priority of my computer to 25. Let's hope this would resolve the issue.

Thank you once again for your help.

[^DooM^]

(very odd. my computer has a higher priority than Internet?)

Not odd at all. If it did not have a higher priority then 127.0.0.1 would fall under the internet ip range which covers all ip's from 0.0.0.0 to 255.255.255.255

[MADhase]

ok... one of our hmailserver users just tried his passwords out today and got banned..
He's now listed as Autoban: Username in the IP Ranges List.

Problem: All users can't login any more now, because 127.0.0.1 (localhost) is now blocked (for at least the auto ban time etc.)

What now? Removing the ban ok... but this problem will occur again some time next time. Can I focus the ban specifically to one username and not the whole user name range?

[MP3Freak]

ok... one of our hmailserver users just tried his passwords out today and got banned..
He's now listed as Autoban: Username in the IP Ranges List.

Problem: All users can't login any more now, because 127.0.0.1 (localhost) is now blocked (for at least the auto ban time etc.)

What now? Removing the ban ok... but this problem will occur again some time next time. Can I focus the ban specifically to one username and not the whole user name range?

Take the 127.0.0x entry in IP-ranges and give it a Priority of 25 or higher. Then that should be solved...

[MADhase]

Oh I forgot to mention in my post.. this user tried to log on from the Squirrelmail Webmail. Hope this doesn't affect the ban system.

[^DooM^]

All connections from SM are 127.0.0.1 so if any of your users incorrectly put their password then everyone on SM will be banned. Setting the Priority to 25 on that IP range will stop that from happening.

[vimaldevk]

I am using 5.2 - b 354 version, i have also configured autoban as you suggested in the above post, i have also configured 127.0.0.1 with 25 priority, autoban is setted to 3/30/60, now i have tried giving the wrong password, now also it says blocked 127.0.0.1 but i can login with same user giving correct password before autoban time, i have configured 127.0.01 with priority 25 and my local lan ranges priority as 10 and 0.0.0.0 255.255.255.255 with priority 0. is there any need to change priority.

[mattg]

If you make your local computer IP range 25 as you say that you have, then this permanent range will override an Autoban range for the same IP address.

The autoban entry will still be made (priority of 20), but the permanent entry will have a higher priority (of 25).

It is as expected then that a user on that IP range doesn't get locked out of your system...

If your permanent entry had a priority of 15 then the autoban range with a priority of 20 would override the permanent setting. This is the point of what the autoban does.

[vimaldevk]

my squirrel mail and hmail are both in one server, my server ip range is 192.168.1.0 - 192.168.1.50, and my other ip ranges 192.168.14.21 to 192.168.14.61, my mail server ip is 192.168.1.18. in this scenario what should be the priorities.

[mattg]

Those 192.168.xxx.xxx numbers overlap. I am confused by what you asking.

Squirrelmail and hMailserver on same machine, then 127.0.0.1 should be priority >21, set to 25 is fine.
If your local LAN is 192.168.1.0 through 192.168.1.XX then you can set a specific IP range for that, but you probably don't need to. If you have a user that uses a mail client from within the local LAN that doesn't store passwords (Thunderbird and Outlook and Outlook express do store passwords by default) then you could also make an IP range for that group with a priority > 21. This would be to stop Autoban from blocking someone who gets their password wrong more than the limit you set.

The internet range should have a priority lower than 20, zero is fine. This would allow the Autoban to override this for specific IPs who are trying a dictionary attack.

Does that make sense?

[^DooM^]

Just a side note the autoban feature was broken in an old 5.2 version It has now been fixed but the latest version is still beta.

http://www.hmailserver.com/?page=downlo ... loadid=186

[martin]

> broken

Well, it did work for 50% of the Internet addresses. Not for the other 50% though...