Hi,
We have noticed lines like the following in our sogo logs:
Wed Oct 31 12:22:22 CET 2018 Oct 31 12:22:22 sogod [25985]:
<0x0x55e5d01df1a0[SOGoWebAuthenticator]> tried wrong password for user
'XBlOMdQZDvM5f86H7iBtmUiCFCxPrvGxVW25E3BHqzga7DU7Kh62fRJ/8hRQ/lwJvJlnygErqla35o8qv3DADhZ85cVGzJIXy+JXqckSn+IZsHlKIf5Tv47Ed5f6JOG+dQby0wd3zUJoWskxpvyPzwNIbKvg9l5BDGGMQlojzPHIvcerv82XEx2RWbRknvqxWYVH+ScREBMvvOGO0PzbOA=='!
Wed Oct 31 12:29:40 CET 2018 Oct 31 12:29:40 sogod [26053]:
<0x0x55e5cfe82c40[SOGoWebAuthenticator]> tried wrong password for user
'+AxMdDC6NgthqY1iIgxWEp8C0fjzXtRVHzN175GP/C0AW6r5d3K5hpSdICSYPoEOgnGWv78AvSU5VmmVx3B39BMKkwBmtFnjd66o0+U1A5mJqs82d0KQU8Qqo/mZ410QJkDbel8BEjs24g98lGAffOdFATpeUkawOK52s9vymkdZGThKwjqMtY36Z0j3P0407x3aEfja+LeMSaFwpexT6w=='!
Wed Oct 31 12:33:06 CET 2018 Oct 31 12:33:06 sogod [25987]:
<0x0x55e5d005b120[SOGoWebAuthenticator]> tried wrong password for user
'+xIpPJifKpSoK0Yez1t6b3G/5wmx7uWGx7RbDKRof+7gcXgU4vK1++l/NG4YGKZNbryHUf9cNdsKPahmogY6cD1O37hK9klMQe9T8vJ9H860n7vq+p3yIgQu01pSp+N6WyxGxu1pCtTu6dWk85wRT/fOZWTi+bE339XmGQZUsKOmKRzWVCjQ4nsZ+Mr0GfSAFCSWJy6EeCYujPcEyC42cQ=='!
SOGo works beautifully, but we wonder what hese log lines mean. The
username is obviously so strange, that it is very unlikely someone
mistyping his/her username.
Does anyone recognise this as something SOGo-internal, perhaps..?
We are using SOGo for regular (email/calendar) web access, plus
ActiveSync and some carddav/caldav. Unfortunately, no IP is logged with
the lines. (they appear at irregular times/frequencies)
Ideas?
MJ
--
users@sogo.nu
https://inverse.ca/sogo/lists
