PLAIN [SASL(-5): bad protocol / cancel: Got more data than we were expecting in the PLAIN plugin

Thu Apr 7 05:34:02 EDT 2016

Hello,

in our environment RedHat Enterpise Linux 6 running cyrus-imapd-2.3.16-13.el6_6.x86_64
from time to time and for a rather short time the log shows messages of the form

cyrus/imap[28810]: badlogin: www.redaktion.tu-berlin.de [130.149.7.200] PLAIN [SASL(-5): bad protocol / cancel: Got more data than we were expecting in the PLAIN plugin

www.redaktion.tu-berlin.de is the only host affected and this is the host running the horde (5.1.3) webmailer.

The user gets an authentication error in this case.

What's behind this? Any pointer to investigate further or solve it?

Kind regards, Frank Elsner
Postmaster Team TUBerlin/tubIT <Postmaster at TU-Berlin.DE> 
Birgit Lennartz  / Frank Elsner
+49 30 314 26191 / +49 30 314 23897