[Dovecot] Intermittent authentication failures

[Eric Shubert]

I'm running dovecot with vpopmail. Here's the configuration:
[root at wong log]# dovecot -n
# 2.0.11: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.18-238.9.1.el5 i686 CentOS release 5.6 (Final)
auth_cache_size = 32 M
auth_mechanisms = plain login digest-md5 cram-md5
auth_username_format = %Lu
first_valid_uid = 89
log_path = /var/log/dovecot.log
login_greeting = Dovecot toaster ready.
mail_fsync = always
mail_nfs_index = yes
mail_nfs_storage = yes
mmap_disable = yes
namespace {
   inbox = yes
   location =
   prefix =
   separator = .
   type = private
}
passdb {
   args = cache_key=%u webmail=127.0.0.1
   driver = vpopmail
}
plugin/quota = maildir
protocols = imap
ssl_cert = </var/qmail/control/servercert.pem
ssl_key = </var/qmail/control/servercert.pem
userdb {
   args = cache_key=%u quota_template=quota_rule=*:backend=%q
   driver = vpopmail
}
protocol imap {
   imap_client_workarounds = delay-newmail
}

Most clients use TLS and PLAIN login for verification, which works 
flawlessly.

I also run SquirrelMail that is slightly dated and has no TLS 
capability, so it is using CRAM-MD5.

CRAM-MD5 works sometimes:
Sep 30 08:15:43 imap-login: Info: Login: user=<userA at domain.com>, 
method=CRAM-MD5, rip=192.168.252.8, lip=192.168.252.14, mpid=20301

but (seemingly more frequently) the authentication fails:
Sep 30 08:16:41 imap-login: Info: Aborted login (auth failed, 1 
attempts): user=<userA at domain.com>, method=CRAM-MD5, rip=192.168.252.8, 
lip=192.168.252.14

I restarted dovecot, and that apparently cleared the problem for one 
user, but not others.

Is this perhaps a bug in dovecot, or would the problem lie with vpopmail?

TIA for any pointers.

-- 
-Eric 'shubes'