Я не знаю, является ли здесь правильное место для такого рода проблем ...
У нас есть внутренний почтовый сервер Zimbra, а с одним конкретным сервером учетной записи / компьютером zimbra просто «блокируем»сеанс и приостановить новые входы в систему с этого устройства.Этот компьютер имеет учетную запись, настроенную в Oulook 2010, и использует другую учетную запись в веб-почте zimbra.Когда сервер Zimbra блокирует сеанс, oulook просто снова открывает форму аутентификации, и, поскольку сервер zimbra заблокировал новые подключения, он не может войти в систему в течение как минимум 30 минут (?).А в веб-почте zimbra отображается сообщение «Произошла ошибка сетевого сервиса».
Что я сделал:
- Make a full scan with BitDefender Anti-virus (i've suspected that maybe a mail bot installed on user computer), but nothing was found
- Checked windows event logs, nothing related to outlook or massive errors/warnings was found
- Tried to check zimbra logs, and all logs are huge and have more than 800mb (compacted) and more than 4gb uncompressed.
below is the part of log with "Access from IP 10.10.10.54 suspended, for repeated failed login." The "10.10.10.54" IP address is the IP from that user which
has the problems. But another interesting thing is that, has another lines in the log with an strange IP address, like an external IP address
Я не знаю, что может вызвать эту проблему или если на клиентском компьютере что-то не так.
Есть идеи?
Часть mailbox.log:
2018-09-20 07:49:52,302 DEBUG [qtp127618319-1101376:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] AuthProvider - zimbra:no auth token
2018-09-20 07:49:52,303 INFO [qtp127618319-1101376:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] misc - Access from IP 74.208.160.99 suspended, for repeated failed login.
2018-09-20 07:49:53,479 DEBUG [qtp127618319-1101329:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] AuthProvider - zimbra:no auth token
2018-09-20 07:49:53,479 INFO [qtp127618319-1101329:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] misc - Access from IP 10.10.10.54 suspended, for repeated failed login.
2018-09-20 07:49:53,523 DEBUG [qtp127618319-1101376:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] AuthProvider - zimbra:no auth token
2018-09-20 07:49:53,524 INFO [qtp127618319-1101376:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] misc - Access from IP 10.10.10.54 suspended, for repeated failed login.
2018-09-20 07:49:53,572 DEBUG [qtp127618319-1101329:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] AuthProvider - zimbra:no auth token
2018-09-20 07:49:53,572 INFO [qtp127618319-1101329:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] misc - Access from IP 10.10.10.54 suspended, for repeated failed login.
2018-09-20 07:49:53,613 DEBUG [qtp127618319-1101376:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] AuthProvider - zimbra:no auth token
2018-09-20 07:49:53,613 INFO [qtp127618319-1101376:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] misc - Access from IP 10.10.10.54 suspended, for repeated failed login.
2018-09-20 07:49:53,675 DEBUG [qtp127618319-1101329:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] AuthProvider - zimbra:no auth token
2018-09-20 07:49:53,675 INFO [qtp127618319-1101329:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] misc - Access from IP 10.10.10.54 suspended, for repeated failed login.
2018-09-20 07:49:53,715 DEBUG [qtp127618319-1101376:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] AuthProvider - zimbra:no auth token
2018-09-20 07:49:53,715 INFO [qtp127618319-1101376:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] misc - Access from IP 10.10.10.54 suspended, for repeated failed login.
2018-09-20 07:49:53,759 DEBUG [qtp127618319-1101329:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] AuthProvider - zimbra:no auth token
2018-09-20 07:49:53,759 INFO [qtp127618319-1101329:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] misc - Access from IP 10.10.10.54 suspended, for repeated failed login.
2018-09-20 07:49:53,803 DEBUG [qtp127618319-1101376:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] AuthProvider - zimbra:no auth token
2018-09-20 07:49:53,803 INFO [qtp127618319-1101376:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] misc - Access from IP 10.10.10.54 suspended, for repeated failed login.
2018-09-20 07:49:54,018 DEBUG [qtp127618319-1101329:https:https://mail.MYDOMAIN.com.br:7073/service/admin/soap/] [] AuthProvider - zimbra:no auth token
