2.3.14: stale imap-login processes due to bogus user setup tying up process limit
Volker Stolz
vs at foldr.org
Tue Jun 1 10:59:59 EEST 2021
I just dealt with an interesting Dovecot issue on our small server, and thought I might share it. I also feel that although in the end it was a configuration error, Dovecot should somehow avoid leaving this processes around and hence filling up the process limit quickly.
- set up Dovecot IMAP on Debian buster (either with the older 2.3.x Debian package, or 2.3.14 from the dovecot-repo)
- config:
...
namespace inbox {
inbox = yes
location =
... default settings ...
...
passdb {
args = scheme=HMAC-MD5 username_format=%u /etc/dovecot/users
driver = passwd-file
}
protocols = " imap"
...
userdb {
args = blocking=no
driver = passwd
}
...
- secret sauce: have a user in the passdb that doesn't have a physical account on the system yet (we were migrating to a new machine).
The log-file shows successful authentication for that user (after we flipped DNS to point to this new machine), but over time (2-3 times/day) we were left with an increasing number of `imap-login` processes in state `pre-login`, eventually requiring a dovecot restart. Dialling up process_limits didn't seem to help, we'd just get more of these stale processes.
After creating the user on the system, the behaviour reverted to normal, no more stale processes. I do not know what error message that user received on their end, but since we announced we were migrating, they probably just ignored it and thought it as part of the transition.
Best,
Volker (a happy & long Dovecot user)
More information about the dovecot
mailing list