Hi,
We have growing imap-login processes until we reach the max
processes.
This occurs when a particular user have a login error due to our LDAP misconfiguration:
---
Mar 4 14:59:33 hera dovecot[2226963]:
auth: Error:
plain(john.doe,XX.XX.XX.XX,<13C0eBP2354lqXpO>): user not
found from any userdbs
Mar 4 14:59:33 hera dovecot[2226963]: imap: Error: auth-master:
login: request [1001652225]: Login auth request failed:
Authenticated user not found from
userdb, auth lookup id=1001652225 (auth connected 2 msecs ago,
request took 1 msecs, client-pid=2235348
client-id=1)
Mar 4 14:59:33 hera dovecot[2226963]: imap-login: Internal
login failure (pid=2235348 id=1): user=<ohn.doe>,
method=PLAIN, rip=XX.XX.XX.XX, lip=18
5.233.100.1, mpid=2235359, TLS, session=<13C0eBP2354lqXpO>
---
The origin of is issue is when passdb finds the user and userdb not. The result is imap-login processes with no timeout growing until we reach the max processes.
Debian stable - Bullseye
dpkg -l |grep
dovecot
ii dovecot-antispam 2.0+20171229-1+b7
amd64 Dovecot plugins for training
spam filters
ii dovecot-common 1:2.1.7-7+deb7u1
all Transitional package for
dovecot
ii dovecot-core 1:2.3.13+dfsg1-2+deb11u1
amd64 secure POP3/IMAP server - core files
ii dovecot-core-dbgsym 1:2.3.13+dfsg1-2+deb11u1
amd64 debug symbols for dovecot-core
ii dovecot-imapd 1:2.3.13+dfsg1-2+deb11u1
amd64 secure POP3/IMAP server - IMAP daemon
ii dovecot-imapd-dbgsym 1:2.3.13+dfsg1-2+deb11u1
amd64 debug symbols for dovecot-imapd
ii dovecot-ldap 1:2.3.13+dfsg1-2+deb11u1
amd64 secure POP3/IMAP server - LDAP support
ii dovecot-managesieved 1:2.3.13+dfsg1-2+deb11u1
amd64 secure POP3/IMAP server - ManageSieve
server
ii dovecot-mysql 1:2.3.13+dfsg1-2+deb11u1
amd64 secure POP3/IMAP server - MySQL
support
ii dovecot-pop3d 1:2.3.13+dfsg1-2+deb11u1
amd64 secure POP3/IMAP server - POP3 daemon
ii dovecot-sieve 1:2.3.13+dfsg1-2+deb11u1
amd64 secure POP3/IMAP server - Sieve
filters support
---
# 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.13 (cdd19fe3)
doveconf: Warning: service auth { client_limit=1000 } is lower
than required under max. load (4096)
doveconf: Warning: service anvil { client_limit=1000 } is lower
than required under max. load (4099)
# OS: Linux 5.10.0-21-cloud-amd64 x86_64 Debian 11.6 ext4
# Hostname: XXX
auth_mechanisms = plain login
default_process_limit = 1024
first_valid_gid = 8
first_valid_uid = 109
last_valid_gid = 8
last_valid_uid = 109
login_greeting = XXX listening.
mail_access_groups = mail
mail_gid = 8
mail_location = maildir:/srv/vmail/%d/%n
mail_privileged_group = mail
mail_uid = 109
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope
encoded-character vacation subaddress comparator-i;ascii-numeric
relational regex imap4flags copy i
nclude variables body enotify environment mailbox date index
ihave duplicate mime foreverypart extracttext imapflags notify
imapsieve vnd.dovecot.imapsieve
vnd.dovecot.filter
namespace inbox {
inbox = yes
location =
mailbox Drafts {
special_use = \Drafts
}
mailbox Junk {
special_use = \Junk
}
mailbox Sent {
special_use = \Sent
}
mailbox "Sent Messages" {
special_use = \Sent
}
mailbox Trash {
special_use = \Trash
}
prefix =
}
passdb {
args = /etc/dovecot/dovecot-ldap.conf
driver = ldap
}
passdb {
args = /etc/dovecot/dovecot-ldap-girondix.conf
driver = ldap
}
passdb {
args = /etc/dovecot/dovecot-oauth2.conf.ext
driver = oauth2
mechanisms = xoauth2 oauthbearer
}
plugin {
quota_rule = *:storage=100M
quota_rule2 = Trash:storage=10%%
recipient_delimiter = +
sieve = /srv/vmail/%d/%n/dovecot.sieve
sieve_default = /var/lib/dovecot/sieve/default.sieve
sieve_dir = /srv/vmail/%d/%n/sieve
sieve_extensions = +notify +imapflags +vnd.dovecot.filter
sieve_filter_bin_dir = /usr/lib/dovecot/sieve-filter
sieve_global_extensions = +vnd.dovecot.pipe
sieve_max_script_size = 1M
sieve_pipe_bin_dir = /etc/dovecot/sieve
sieve_pipe_socket_dir = sieve-pipe
sieve_plugins = sieve_imapsieve sieve_extprograms
sieve_redirect_envelope_from = orig_recipient
}
protocols = imap pop3 sieve
service auth {
unix_listener /var/spool/postfix/private/auth {
group = mail
mode = 0600
user = postfix
}
unix_listener auth-master {
group = mail
mode = 0660
user = vmail
}
unix_listener auth-userdb {
group = mail
mode = 0600
user = vmail
}
}
service imap-login {
inet_listener imap {
port = 0
}
}
service imap {
vsz_limit = 1 G
}
service lmtp {
executable = lmtp -L
process_min_avail = 2
}
service pop3-login {
inet_listener pop3 {
port = 0
}
}
ssl_cert = </srv/letsencrypt/pem/mail.aquilenet.fr.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_dh = # hidden, use -P to show it
ssl_key = # hidden, use -P to show it
userdb {
args = /etc/dovecot/dovecot-ldap.conf
driver = ldap
}
userdb {
args = /etc/dovecot/dovecot-ldap-girondix.conf
driver = ldap
}
protocol lmtp {
auth_username_format = %n
info_log_path = /var/log/dovecot-lmtp.log
mail_plugins = " sieve"
}
protocol lda {
mail_plugins = " mailbox_alias sieve"
}
protocol imap {
imap_client_workarounds = delay-newmail tb-extra-mailbox-sep
imap_idle_notify_interval = 30 secs
mail_max_userip_connections = 50
mail_plugins = quota mailbox_alias imap_quota
}
protocol pop3 {
mail_plugins = quota mailbox_alias acl
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
}
---