After updating mailcow to the latest 2/2025 I'm getting this message in mc logfiles every minute or less: dovecot: auth-worker(xx): conn unix:auth-worker (pid=xxx,uid=xxx): auth-worker: sql(watchdog@invalid, xxx.xxx.xxx.xxx): unknown user Does anyone know where this may come from (fail2ban) and why this occurs after updating? Anything else seems to be quite fine 🙂

@"yoobeedoobee"#p22763 The "unkown user" is because the watchdog only connects and waits for the welcome string. It then disconnects without further authentication, hence the user is unkown. > @"yoobeedoobee"#p22763 I just hope that watchdog does not trigger netfilter/fail2ban to blacklist itself. If that would be the case everyone would have this problems since quite some time ;)

auth-worker<xx>: sql(watchdog@invalid,xxx.xxx.xxx.xxx): unknown user #015

yoobeedoobee

After updating mailcow to the latest 2/2025 I’m getting this message in mc logfiles every minute or less:
dovecot: auth-worker(xx): conn unix:auth-worker (pid=xxx,uid=xxx): auth-worker<xxx>: sql(watchdog@invalid, xxx.xxx.xxx.xxx): unknown user
Does anyone know where this may come from (fail2ban) and why this occurs after updating?
Anything else seems to be quite fine 🙂

DocFraggle

My dovecot log shows the same message

esackbauer

If you look at the surrounding log lines and the IP address, you will notice that it is the watchdog testing if dovecot ist still running.
I bet is has been there before 😉 If not, maybe devs changed the watchdog.

yoobeedoobee

No, I have two instances of mailcow running, one still @ 11/24 and this one has this log:
Connect from 172.22.1.8#015
dovecot: lmtp(124754): Disconnect from 172.22.1.8: Logged out (state=MAIL FROM)#015

This seems (at least from my point of view) not as problematic.
I just hope that watchdog does not trigger netfilter/fail2ban to blacklist itself.
The “unknown user” message is a fail2ban message for the dovecot filter

esackbauer

yoobeedoobee
The “unkown user” is because the watchdog only connects and waits for the welcome string. It then disconnects without further authentication, hence the user is unkown.

yoobeedoobee I just hope that watchdog does not trigger netfilter/fail2ban to blacklist itself.

If that would be the case everyone would have this problems since quite some time 😉