dovecot - Sep 2011 - Intermittent authentication failures

I'm running dovecot with vpopmail. Here's the configuration:
[root at wong log]# dovecot -n
# 2.0.11: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.18-238.9.1.el5 i686 CentOS release 5.6 (Final)
auth_cache_size = 32 M
auth_mechanisms = plain login digest-md5 cram-md5
auth_username_format = %Lu
first_valid_uid = 89
log_path = /var/log/dovecot.log
login_greeting = Dovecot toaster ready.
mail_fsync = always
mail_nfs_index = yes
mail_nfs_storage = yes
mmap_disable = yes
namespace {
   inbox = yes
   location    prefix    separator = .
   type = private
}
passdb {
   args = cache_key=%u webmail=127.0.0.1
   driver = vpopmail
}
plugin/quota = maildir
protocols = imap
ssl_cert = </var/qmail/control/servercert.pem
ssl_key = </var/qmail/control/servercert.pem
userdb {
   args = cache_key=%u quota_template=quota_rule=*:backend=%q
   driver = vpopmail
}
protocol imap {
   imap_client_workarounds = delay-newmail
}

Most clients use TLS and PLAIN login for verification, which works 
flawlessly.

I also run SquirrelMail that is slightly dated and has no TLS 
capability, so it is using CRAM-MD5.

CRAM-MD5 works sometimes:
Sep 30 08:15:43 imap-login: Info: Login: user=<userA at domain.com>, 
method=CRAM-MD5, rip=192.168.252.8, lip=192.168.252.14, mpid=20301

but (seemingly more frequently) the authentication fails:
Sep 30 08:16:41 imap-login: Info: Aborted login (auth failed, 1 
attempts): user=<userA at domain.com>, method=CRAM-MD5, rip=192.168.252.8,
lip=192.168.252.14

I restarted dovecot, and that apparently cleared the problem for one 
user, but not others.

Is this perhaps a bug in dovecot, or would the problem lie with vpopmail?

TIA for any pointers.

-- 
-Eric 'shubes'

On 09/30/2011 09:07 AM, Eric Shubert wrote:
>
> CRAM-MD5 works sometimes:
> Sep 30 08:15:43 imap-login: Info: Login: user=<userA at domain.com>,
> method=CRAM-MD5, rip=192.168.252.8, lip=192.168.252.14, mpid=20301
>
> but (seemingly more frequently) the authentication fails:
> Sep 30 08:16:41 imap-login: Info: Aborted login (auth failed, 1
> attempts): user=<userA at domain.com>, method=CRAM-MD5,
rip=192.168.252.8,
> lip=192.168.252.14
>
> I restarted dovecot, and that apparently cleared the problem for one
> user, but not others.
>
> Is this perhaps a bug in dovecot, or would the problem lie with vpopmail?
>
> TIA for any pointers.
>
FWIW, I tried digest-md5, and experience the same problem.

Is it possible that passwords are being cached in such a way that 
different login mechanisms cannot be used by different client programs 
with the same user account?

-- 
-Eric 'shubes'