topic Re: Errors in syslog ... ???? in Operating System - HP-UX

Errors in syslog ... ????

RNC — Mon, 29 Jan 2007 04:19:14 GMT

Hello all,

I recive the next message in the syslog since some days ago and with 2 minutes of different:

Jan 29 10:10:49 inetd[15341]: pop3/tcp: Connection from unknown (IP_address) at Mon Jan 29 10:10:49 2007
Jan 29 10:10:49 popper[15341]: (v2.53) Unable to get canonical name of client, err = 0
Jan 29 10:10:49 popper[15341]: @[IP_address]: -ERR Too few arguments for the auth command.

Thanks in advanced

Re: Errors in syslog ... ????

Ralph Grothe — Mon, 29 Jan 2007 04:33:40 GMT

Seems your pop server is visited by a client whose domain name cannot be resolved,
and who isn't authenticating correctly to your pop server.

Re: Errors in syslog ... ????

Steven E. Protter — Mon, 29 Jan 2007 04:36:11 GMT

Shalom RNC,

Looks to me like there is a pop3 connection from a system that can not be looked up on DNS.

This could be because there is no entry on the central DNS server referenced in /etc/resolv.conf.

It could be because that server is blocking port 53 dns lookups.

It could be that the DNS server simply isn't a DNS server.

It would appear the current qpopper settings require a name lookup. This may be expecting too much as pop3 clients can conceivably be coming in from any part of the world, depending on the Internet exposure of this system.

SEP

Re: Errors in syslog ... ????

Wouter Jagers — Mon, 29 Jan 2007 04:41:00 GMT

My educated guess:

1st message: An 'unknown' client connects to the pop service (to fetch some mail, let's presume).

2nd message: Only an IP address is known, the system is not able to retrieve the client's hostname.

3rd message: This 'unknown' client tries to use an authentication method which the server does not support.

Cheers
Wout