dovecot - Sep 2007 - pipe() error but not linked to kqueue

I have dovecot 1.0.5 installed on an OpenBSD 4.1 box and an OS X  
Server 10.4.10 box.

Sure you've all heard it before, because of the pipe error, no more  
login processes can be launched, and I have to restart the server.

dovecot: Sep 13 05:50:00 Error: pipe() failed: Too many open files

I first thought this was the issue with kqueue, but I've since  
recompiled making sure to use poll. This also happened with 1.0.3 and  
1.0.2.

It also happens very specifically after a dictionary attack that  
lasts usually about an hour, unless I can catch it earlier. (Around  
18,000 login attempts)
ex:
dovecot: Sep 13 05:49:58 Info: pop3-login: Aborted login:  
user=<aaron>, method=PLAIN, rip=62.161.41.32, lip=<local ip>
dovecot: Sep 13 05:49:58 Info: pop3-login: Aborted login: user=<adm>,  
method=PLAIN, rip=62.161.41.32, lip=<local ip>
dovecot: Sep 13 05:49:58 Info: pop3-login: Aborted login:  
user=<account>, method=PLAIN, rip=62.161.41.32, lip=<local ip>

But after the attack has subsided for a period of time, I still have  
the number of file descriptors maxed out for the dovecot process.  
I've increased the number available to have a higher roof, but that  
doesn't fix the problem.

Wondering if anyone else has seen this issue, and also in a generic  
problem. How are others dealing the the problem of being attacked in  
this method? Is there a max number of login tries for a given ip  
address within a period of time that I'm missing? :)

Thanks,
Patrick

Patrick Milvich wrote:
> I have dovecot 1.0.5 installed on an OpenBSD 4.1 box and an OS X Server
> 10.4.10 box.
> 
> Sure you've all heard it before, because of the pipe error, no more
> login processes can be launched, and I have to restart the server.
> 
> dovecot: Sep 13 05:50:00 Error: pipe() failed: Too many open files
...
> Wondering if anyone else has seen this issue, and also in a generic
> problem. How are others dealing the the problem of being attacked in
> this method? Is there a max number of login tries for a given ip address
> within a period of time that I'm missing? :)
I see the same type of error on our system (Solaris 10, Dovecot 1.0.3).
I've had to up the limit of file descriptors to 16384 for the
"dovecot"
process so that it will be able to run for a sane amount of time before
running out.

The strange thing is that it normally stay around 250 used file
descriptors (we have about 350 users here, not everyone using the system
at the same time) and then suddenly things runs amok...

- Peter

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 185 bytes
Desc: OpenPGP digital signature
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20070914/1412a08a/attachment-0002.bin>