[remote: ?nobody@?nowhere] ???

[Ciprian Vizitiu]

Hi listers.

I have a cyrus-imapd-2.2.8-1 and cyrus-sasl-2.1.15-10 via saslauthd 
running on a RHEL 3.0 u3. Authentication is done via PAM which in turn 
uses LDAP. Everything seems to work just fine, users can read IMAP 
inboxes and do sieve except... I regularly see in /var/log/messages two 
lines:

Oct 28 23:23:43 server imap(pam_unix)[2213]: check pass; user unknown
Oct 28 23:23:43 server imap(pam_unix)[2213]: authentication failure; 
logname= uid=0 euid=0 tty= ruser= rhost=

Now 2213 looks like a saslauthd PID to me in fact there is a saslauthd 
with that PID. I've inserted a pam_warn in the imap part of pam.d and in 
turn now I've got:

Oct 28 23:23:43 server PAM-warn[2213]: service: imap [on terminal: 
<unknown>]
Oct 28 23:23:43 server PAM-warn[2213]: user: (uid=0) -> user123 [remote: 
?nobody@?nowhere]
Oct 28 23:23:43 server imap(pam_unix)[2213]: check pass; user unknown
Oct 28 23:23:43 server imap(pam_unix)[2213]: authentication failure; 
logname= uid=0 euid=0 tty= ruser= rhost=

Does anybody have *any* sugestion? I don't even know where to start this 
one since everything is working... :-o Or at least it seems to.