dovecot - Oct 2007 - Dovecot hanging up with many defunct processes

Hi,

    I am in a very awkward situation and need some kind of immediate fix up.
I had installed dovecot in my organization as part of migration of email
server. The setup involves sendmail, dovecot (imaps+pop3s) and webmail
(squirrelmail) running on apache webserver. All was working fine until one
day I found a lot of defunct processes on system related to dovecot.
dovecot-auth, imap-login and imap were all defunct. The system is using
pam_ldap and nss_ldap to authenticate users to a Windows 2003 Active
Directory. Immediate restart of dovecot solved the problem for me that day,
however since then it's been about 3 times that I've faced this problem.
After visiting various forums I came to know one thing, that it has
something to do with pam_ldap and nss_ldap. However with UW-IMAP we were
using the same setup and we didn't find any problems there.
        It would be very kind of you, if you can help me out on this front
as apart from these mishaps the mail server is running perfectly fine and we
wish to continue using Dovecot for our setup in future as well.
        Following is the system details:

1) OS: RHEL4 (Kernel - 2.6.9-5.ELsmp)
2) Dovecot: Dovecot (Version - 1.0.3)
3) Following is dovecot configuration:
     log_path: /var/log/dovecot.log
     protocols: imaps pop3s
     ssl_cert_file: /usr/share/ssl/certs/imapd.pem
     ssl_key_file: /usr/share/ssl/private/imapd.pem
     login_dir: /usr/local/var/run/dovecot/login
     login_executable(default): /usr/local/libexec/dovecot/imap-login
     login_executable(imap): /usr/local/libexec/dovecot/imap-login
     login_executable(pop3): /usr/local/libexec/dovecot/pop3-login
     max_mail_processes: 10240
     mail_location: mbox:~/mail:INBOX=/var/mail/%u
     mail_executable(default): /usr/local/libexec/dovecot/imap
     mail_executable(imap): /usr/local/libexec/dovecot/imap
     mail_executable(pop3): /usr/local/libexec/dovecot/pop3
     mail_plugin_dir(default): /usr/local/lib/dovecot/imap
     mail_plugin_dir(imap): /usr/local/lib/dovecot/imap
     mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3
     pop3_uidl_format(default):
     pop3_uidl_format(imap):
     pop3_uidl_format(pop3): %08Xu%08Xv
     auth default:
     passdb:
         driver: pam
     userdb:
         driver: passwd
4) Dovecot's PAM file (/etc/pam.d/dovecot)
     #%PAM-1.0
     auth    required pam_ldap.so
     account required pam_ldap.so
     session required pam_mkhomedir.so skel=/etc/skel umask=0077
     session required pam_ldap.so

As far as I feel it's problem with pam_ldap not able to authenticate against
Windows 2003 Active Directory due to some reason or the other. However I'm
not sure why is this happening.


Regards,

Mayank Joshi.

Mayank Joshi wrote:
> 
>      passdb:
>          driver: pam
>      userdb:
>          driver: passwd
> 4) Dovecot's PAM file (/etc/pam.d/dovecot)
>      #%PAM-1.0
>      auth    required pam_ldap.so
>      account required pam_ldap.so
>      session required pam_mkhomedir.so skel=/etc/skel umask=0077
>      session required pam_ldap.so
Our situation is similar (but not exact) to yours - I'm authenticating 
against LDAP though and not AD2003. Perhaps one of these settings I use 
may help:

dovecot.conf:
   login_process_per_connection: no

   auth default:
     cache_size: 4096
     cache_ttl: 7200
     passdb:
       driver: pam
       args: cache_key=%u dovecot
     userdb:
       driver: passwd
       args: blocking=yes

The blocking=yes in the userdb might be the first thing you try, see 
these wiki pages for the reasons I have it like this:

   http://wiki.dovecot.org/UserDatabase/NSS
   http://wiki.dovecot.org/AuthDatabase/Passwd

Additionally my pam.d dovecot uses the system stack, which *then* uses 
nss_ldap on it's own; I don't specifically bind pam_ldap into the 
dovecot pam.d file:

   # cat /etc/pam.d/dovecot
   #%PAM-1.0
   auth       required     pam_nologin.so
   auth       required     pam_stack.so service=system-auth
   account    required     pam_stack.so service=system-auth
   session    required     pam_stack.so service=system-auth

In this case the file /etc/nsswitch.conf is controlling my 
authentication mechanism (LDAP), and the pam_ldap.so stack entry is 
located in /etc/pam.d/system-auth (these are all Red Hat defaults out of 
the box).

Hope some of this helps,
-te

-- 
Troy Engel | Systems Engineer
Fluid, Inc | http://www.fluid.com

Hi Mayank,

Mayank Joshi schrieb:
> dovecot-auth, imap-login and imap were all defunct. The system is using
> pam_ldap and nss_ldap to authenticate users to a Windows 2003 Active
> Directory. Immediate restart of dovecot solved the problem for me that day,
> however since then it's been about 3 times that I've faced this
problem.
> After visiting various forums I came to know one thing, that it has
> something to do with pam_ldap and nss_ldap. However with UW-IMAP we were
> using the same setup and we didn't find any problems there.
>         Following is the system details:
>      passdb:
>          driver: pam
Not sure if it will solve your problem, but you probably want to set
    args = blocking=yes
in your passdb or switch to direct LDAP queries.

http://wiki.dovecot.org/PasswordDatabase/PAM#head-71368e6eb385969ff27fcda066555b9c05822c09

	Benjamin

-- 
Benjamin Dabelow                      benjamin at dabelow.eu

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20071009/b6f6153e/attachment-0002.bin>