efa-project.org

Hi,

does someone know if MailWatch writes failed login attempts to a log file?

cheers,
Tobias

Yes, take a look in the apache logs. You should see the failure responses logged.

The only thing I found was this line in "ssl_request_log": this is not really something I could track with fail2ban because if someone just posts the login form but does not follow the redirect this is not called.
and on the other hand this adress could be called even if nothing was entered in the login mask.

do you think there is real authentication failure entry somewhere?

This would be a good question for MailWatch. I think there is an audit table in the database that might log failures.