Hi,
We have growing imap-login processes until we reach the max processes.
This occurs when a particular user have a login error due to our LDAP
misconfiguration:
---
Mar? 4 14:59:33 hera dovecot[2226963]: auth: Error:
plain(john.doe,XX.XX.XX.XX,<13C0eBP2354lqXpO>): user not found from any
userdbs
Mar? 4 14:59:33 hera dovecot[2226963]: imap: Error: auth-master: login:
request [1001652225]: Login auth request failed: Authenticated user not
found from
userdb, auth lookup id=1001652225 (auth connected 2 msecs ago, request
took 1 msecs, client-pid=2235348 client-id=1)
Mar? 4 14:59:33 hera dovecot[2226963]: imap-login: Internal login
failure (pid=2235348 id=1): user=<ohn.doe>, method=PLAIN,
rip=XX.XX.XX.XX, lip=18
5.233.100.1, mpid=2235359, TLS, session=<13C0eBP2354lqXpO>
---
The origin of is issue is when passdb finds the user and userdb not. The
result is imap-login processes with no timeout growing until we reach
the max processes.
* OS version
Debian stable - Bullseye
* Dovecot version
dpkg -l |grep dovecot
ii ?dovecot-antispam ???????????????????2.0+20171229-1+b7
????????????????????amd64 ???????Dovecot plugins for training spam filters
ii ?dovecot-common ?????????????????????1:2.1.7-7+deb7u1
?????????????????????all ?????????Transitional package for dovecot
ii ?dovecot-core ???????????????????????1:2.3.13+dfsg1-2+deb11u1
?????????????amd64 ???????secure POP3/IMAP server - core files
ii ?dovecot-core-dbgsym ????????????????1:2.3.13+dfsg1-2+deb11u1
?????????????amd64 ???????debug symbols for dovecot-core
ii ?dovecot-imapd ??????????????????????1:2.3.13+dfsg1-2+deb11u1
?????????????amd64 ???????secure POP3/IMAP server - IMAP daemon
ii ?dovecot-imapd-dbgsym ???????????????1:2.3.13+dfsg1-2+deb11u1
?????????????amd64 ???????debug symbols for dovecot-imapd
ii ?dovecot-ldap ???????????????????????1:2.3.13+dfsg1-2+deb11u1
?????????????amd64 ???????secure POP3/IMAP server - LDAP support
ii ?dovecot-managesieved ???????????????1:2.3.13+dfsg1-2+deb11u1
?????????????amd64 ???????secure POP3/IMAP server - ManageSieve server
ii ?dovecot-mysql ??????????????????????1:2.3.13+dfsg1-2+deb11u1
?????????????amd64 ???????secure POP3/IMAP server - MySQL support
ii ?dovecot-pop3d ??????????????????????1:2.3.13+dfsg1-2+deb11u1
?????????????amd64 ???????secure POP3/IMAP server - POP3 daemon
ii ?dovecot-sieve ??????????????????????1:2.3.13+dfsg1-2+deb11u1
?????????????amd64 ???????secure POP3/IMAP server - Sieve filters support
* doveconf -n
---
# 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.13 (cdd19fe3)
doveconf: Warning: service auth { client_limit=1000 } is lower than
required under max. load (4096)
doveconf: Warning: service anvil { client_limit=1000 } is lower than
required under max. load (4099)
# OS: Linux 5.10.0-21-cloud-amd64 x86_64 Debian 11.6 ext4
# Hostname: XXX
auth_mechanisms = plain login
default_process_limit = 1024
first_valid_gid = 8
first_valid_uid = 109
last_valid_gid = 8
last_valid_uid = 109
login_greeting = XXX listening.
mail_access_groups = mail
mail_gid = 8
mail_location = maildir:/srv/vmail/%d/%n
mail_privileged_group = mail
mail_uid = 109
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope
encoded-character vacation subaddress comparator-i;ascii-numeric
relational regex imap4flags copy i
nclude variables body enotify environment mailbox date index ihave
duplicate mime foreverypart extracttext imapflags notify imapsieve
vnd.dovecot.imapsieve
vnd.dovecot.filter
namespace inbox {
?inbox = yes
?location ?mailbox Drafts {
???special_use = \Drafts
?}
?mailbox Junk {
???special_use = \Junk
?}
?mailbox Sent {
???special_use = \Sent
?}
?mailbox "Sent Messages" {
???special_use = \Sent
?}
?mailbox Trash {
???special_use = \Trash
?}
?prefix }
passdb {
?args = /etc/dovecot/dovecot-ldap.conf
?driver = ldap
}
passdb {
?args = /etc/dovecot/dovecot-ldap-girondix.conf
?driver = ldap
}
passdb {
?args = /etc/dovecot/dovecot-oauth2.conf.ext
?driver = oauth2
?mechanisms = xoauth2 oauthbearer
}
plugin {
?quota_rule = *:storage=100M
?quota_rule2 = Trash:storage=10%%
?recipient_delimiter = +
?sieve = /srv/vmail/%d/%n/dovecot.sieve
?sieve_default = /var/lib/dovecot/sieve/default.sieve
?sieve_dir = /srv/vmail/%d/%n/sieve
?sieve_extensions = +notify +imapflags +vnd.dovecot.filter
?sieve_filter_bin_dir = /usr/lib/dovecot/sieve-filter
?sieve_global_extensions = +vnd.dovecot.pipe
?sieve_max_script_size = 1M
?sieve_pipe_bin_dir = /etc/dovecot/sieve
?sieve_pipe_socket_dir = sieve-pipe
?sieve_plugins = sieve_imapsieve sieve_extprograms
?sieve_redirect_envelope_from = orig_recipient
}
protocols = imap pop3 sieve
service auth {
?unix_listener /var/spool/postfix/private/auth {
???group = mail
???mode = 0600
???user = postfix
?}
?unix_listener auth-master {
???group = mail
???mode = 0660
???user = vmail
?}
?unix_listener auth-userdb {
???group = mail
???mode = 0600
???user = vmail
?}
}
service imap-login {
?inet_listener imap {
???port = 0
?}
}
service imap {
?vsz_limit = 1 G
}
service lmtp {
?executable = lmtp -L
?process_min_avail = 2
}
service pop3-login {
?inet_listener pop3 {
???port = 0
?}
}
ssl_cert = </srv/letsencrypt/pem/mail.aquilenet.fr.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_dh = # hidden, use -P to show it
ssl_key = # hidden, use -P to show it
userdb {
?args = /etc/dovecot/dovecot-ldap.conf
?driver = ldap
}
userdb {
?args = /etc/dovecot/dovecot-ldap-girondix.conf
?driver = ldap
}
protocol lmtp {
?auth_username_format = %n
?info_log_path = /var/log/dovecot-lmtp.log
?mail_plugins = " sieve"
}
protocol lda {
?mail_plugins = " mailbox_alias sieve"
}
protocol imap {
?imap_client_workarounds = delay-newmail tb-extra-mailbox-sep
?imap_idle_notify_interval = 30 secs
?mail_max_userip_connections = 50
?mail_plugins = quota ?mailbox_alias imap_quota
}
protocol pop3 {
?mail_plugins = quota mailbox_alias acl
?pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
}
---
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20230304/1644cad0/attachment.htm>