Problem with MAC and pop3 login

[Richard G]

Two customers of mine have a MAC and a problem.
If they are using pop 3, after a couple of logins they get a pop 3 authentication error and ofcouse after several of those the BFM of DA will put them in the firewall.

One of the users went over to IMAP and then the problem was gone.

Now the second customer who came later, had the same problem. Went to imap and even set the smtp server to the smtp server of her own ISP to prevent problems. This was ongoing until May 27 when we moved servers.

Still, the bruteforce monitor detects this:

May 29 05:52:31 pop3-login: Aborted login (auth failed, 1 attempts in 2 secs)
May 29 06:22:36 pop3-login: Aborted login (auth failed, 1 attempts in 2 secs)
May 29 06:42:19 pop3-login: Aborted login (auth failed, 1 attempts in 2 secs)

Strange thing is that this was on a new server and at that time (05.52 am) she was a sleep and her Mac was also in sleepmode. Next to that it's strange that it did not happen before or did not happen the 28th after the server move was completed.
She has no account on her telephone anymore (she removed it she said) and a nephew of mine deleted her pop3 account on her Mac and created a new Imap account.

Today she found there was some Java Subpub or something she caught, but after removing this she keeps running into my firewall every half our again. So every time something is checking mail.
My nephew checked, all settings are the same as his mail settings, except he is still using the smtp of the domain which she can't because that will put her in the blacklist too.

As I don't have any clue about Mac computers and she's the only one having this problem, I wonder if any of you guys ran into something like this and know a solution.

Because my newphew also had the exact same authentication failure problems when using pop3 with the MAC which dissapeared after changing to Imap.

 

[Richard G]

I just found out that Mac Mail often has problems with smtp.

But why is there a Pop3 login failure from BFM when Imap is used??

 

[zEitEr]

No idea about MAC, but you might try and find clues in logs. So you might need to enable debugging in Dovecot:

auth_verbose=yes enables logging all failed authentication attempts.

auth_debug=yes enables all authentication debug logging (also enables auth_verbose).

Related: http://wiki2.dovecot.org/Logging

p.s. Very often my Windows Notebook even in sleep mode during a night collects emails from IMAP/POP3 server. Though I don't worry much about that... that seems a little bit frustrating.

 

[Richard G]

Thank you, I'm going to try debugging, it's just one customer so I don't think it's some serverside problem. But it's always interesting to learn what's causing it.
Turned debugging on.

 

[Richard G]

Well debugging does not add very much more.

auth: Debug: client passdb out: FAIL#0111#[email protected]

And there was already a password mismatch notice in the non-debug log.

 

[nobaloney]

I've had the problem reported by several clients as well, and my recollection is that the problem is that Mac Mail by default tries to use multiple ports, and of course some of them always fail. I'd suggest using the correct port rather than letting the MAC try all.

Jeff

 

[Richard G]

Thank you Jeff, I will advise the client on that.

 

[ebrainnight]

smtp problem is quite often in Mac Mail and it is frustrating too, but we are not having a best solution yet.

 

[Richard G]

Thank you for your reply.

In the meantime I found out that a solution could be to set a static port. It came to my attention that Mac Mail will automatically scan al 3 smtp ports. So port 25, 465 and 587 is scanned on sending mail. When a connection is made on any of the ports, the mail will be send. However, it could be that if not all these ports are present on a server, the firewall or bruteforce monitor could see this as port scanning or port knocking, and as a result block the user.

Unfortunately this was not the solution to my customers problem, but I like to bring it to attention.
If a Mac Mail user keeps having problems with pop3, this sometimes can be solved by having the user use Imap instead of Pop3.

I wanted to share this info with everybody, in case somebody else would walk into "Mac troubles".

This solution worked for one of my customers, however he has a slightly newer version of OS and Mac Mail too. Other customers with a Mac on every other server we support, don't have any problems.

The customer which has the problems, had a trojan before, which is removed. She removed the domain email addresses completely from her Mac, so the problem should be over. However, every half an hour, still a connection is made, trapping the brute force monitor ofcourse. But according to her, there is no email address present anymore, neither on other equipment (like phone or ipad).

So there must be something hidden on some equipment or she isn't looking good. I advised here to format and reinstall.

Thank you for thinking with me. In this case the imap solution worked for one customer, and the other problem is clearly caused by one of the machines of the customer itself.