Hi,
Sometimes a script kiddie tries to guess passwords on our mailserver (Ubuntu 10.04.2 LTS, postfix, dovecot 1.2.9, scanners, the standard stuff). That leads to a nagios message about the high number of processes. The number goes above 500. Nagios threshold is set to 250, which is more than enough for normal operation of this server. When are these processes supposed to die again? They seem to stay at the high count quite long.
Is there a way to limit the generation of extra login processes? Can I tune the login_process... params a bit? I have then all on default.
dovecot - n below:
root@mail-dev:/etc/dovecot# dovecot -n # 1.2.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-32-server x86_64 Ubuntu 10.04.2 LTS log_path: /var/log/dovecot/error.log info_log_path: /var/log/dovecot/info.log log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap pop3 imaps pop3s listen: *, [::] ssl_cert_file: /disk/site/etc/ssl/hobby.nl/hobby.nl.crt ssl_key_file: /disk/site/etc/ssl/hobby.nl/hobby.nl.key ssl_cipher_list: ALL:!LOW:!SSLv2:ALL:!aNULL:!ADH:!eNULL:!EXP:RC4+RSA:+HIGH:+MEDIUM disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/pop3-login first_valid_uid: 200 mail_privileged_group: vmail mail_location: maildir:~/Maildir mmap_disable: yes dotlock_use_excl: no mail_nfs_storage: yes mail_nfs_index: yes mbox_write_locks: fcntl dotlock mail_executable(default): /usr/lib/dovecot/imap-wrapper.sh mail_executable(imap): /usr/lib/dovecot/imap-wrapper.sh mail_executable(pop3): /usr/lib/dovecot/pop3-wrapper.sh mail_plugins: convert autocreate mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3 imap_client_workarounds(default): outlook-idle delay-newmail imap_client_workarounds(imap): outlook-idle delay-newmail imap_client_workarounds(pop3): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh lda: postmaster_address: postmaster deliver_log_format: msgid=%m: %$ rejection_subject: Rejected: %s rejection_reason: Your message to <%t> was automatically rejected:%n%r auth_socket_path: /var/run/dovecot/auth-master auth default: mechanisms: plain login realms: kader.hcc.nl hobby.nl default_realm: kader.hcc.nl cache_size: 1024 cache_ttl: 10 passdb: driver: pam args: failure_show_msg=yes cache_key=%u dovecot passdb: driver: sql args: /etc/dovecot/dovecot-sql.conf userdb: driver: sql args: /etc/dovecot/dovecot-sql.conf socket: type: listen client: path: /var/spool/postfix/private/dovecot-auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: vmail group: vmail plugin: convert_mail: mbox:/disk/mail/convert/%n autocreate: Trash autocreate2: Sent autocreate3: Drafts autocreate4: Spam autosubscribe: Trash autosubscribe2: Sent autosubscribe3: Drafts autosubscribe4: Spam
login_process defaults: #login_user = dovecot #login_process_size = 64 #login_process_per_connection = yes #login_processes_count = 3 #login_max_processes_count = 128 #login_max_connections = 256
lsof -n output (part of long list): dovecot-a 12941 root 17u unix 0xffff88012a457300 0t0 13606994 /var/run/dovecot/login/default dovecot-a 12941 root 18u unix 0xffff8800272bd800 0t0 13565904 /var/run/dovecot/login/default dovecot-a 12941 root 19u unix 0xffff8800a68a9800 0t0 13610586 /var/run/dovecot/login/default
TNX for any advise! Egbert Jan HCC!Hobbynet, NL