I've mentioned this before but only heard from one other person who
has experienced this, but it's becoming a pretty serious issue.
The situation:
A spammer sets a bot on a fishing attempt to gain email addresses,
causing numerous login processes to spawn and suck up all available
resources.
The problem:
Obviously this can act like a dos attack, but the real issue is after
the spammer stops (by virtue of being added to our firewall blacklist,
being caught and shut down by their isp, or otherwise), dovecot
doesn't seem to relinquish the resources, causing "too many files
open" errors for normal usage.
The master process usually hangs around 40-50 files open at any given
time, with about 10,000 logins a day (I use: lsof -p `cat /var/run/
dovecot/master.pid ` | wc -l), after the attempt is over I always see
the files open shoot up to near 3,000 without it able to go down until
a dovecot restart.
This usually happens about once a month, though we can get unlucky and
have it happen a few days apart. I have some log excerpts below.
Wondering if this is happening through my own fault or at least within
my ability to alleviate the issue. Is there a way to limit the number
of connections from an ip address? Has anyone used login_executable to
first hit their own solution to keep track of, and implement
connection restrictions similar to what I'm aiming for?
Thanks for any insight
Patrick
dovecot -n
# 1.0.8: /usr/local/mail/dovecot/etc/dovecot.conf
base_dir: /var/run/dovecot/
log_path: /var/log/dovecot
protocols: imap imaps pop3 pop3s
ssl_cert_file: /usr/local/mail/ssl/certs/dovecot.pem
ssl_key_file: /usr/local/mail/ssl/private/dovecot.pem
ssl_cipher_list: ALL:!LOW
disable_plaintext_auth: no
login_dir: /var/run/dovecot/login
login_executable(default): /usr/local/mail/dovecot/libexec/dovecot/
imap-login
login_executable(imap): /usr/local/mail/dovecot/libexec/dovecot/imap-
login
login_executable(pop3): /usr/local/mail/dovecot/libexec/dovecot/pop3-
login
first_valid_uid: 500
mail_location: maildir:/Volumes/data/mail/%Ld/%Ln
mail_executable(default): /usr/local/mail/dovecot/libexec/dovecot/imap-
before
mail_executable(imap): /usr/local/mail/dovecot/libexec/dovecot/imap-
before
mail_executable(pop3): /usr/local/mail/dovecot/libexec/dovecot/pop3-
before
mail_plugin_dir(default): /usr/local/mail/dovecot/lib/dovecot/imap
mail_plugin_dir(imap): /usr/local/mail/dovecot/lib/dovecot/imap
mail_plugin_dir(pop3): /usr/local/mail/dovecot/lib/dovecot/pop3
pop3_uidl_format(default):
pop3_uidl_format(imap):
pop3_uidl_format(pop3): %08Xu%08Xv
auth default:
mechanisms: plain digest-md5 login
passdb:
driver: sql
args: /usr/local/mail/dovecot/etc/dovecot-sql.conf
userdb:
driver: static
args: uid=exim gid=exim
plugin:
quota: maildir
From the logs, first entries showing the problem:
dovecot: Dec 10 16:17:02 Info: pop3-login: Disconnected:
rip=207.245.39.90, lip=<lip>
dovecot: Dec 10 16:17:02 Info: pop3-login: Disconnected:
rip=207.245.39.90, lip=<lip>
dovecot: Dec 10 16:17:03 Info: pop3-login: Disconnected:
rip=207.245.39.90, lip=<lip>
dovecot: Dec 10 16:17:03 Info: pop3-login: Disconnected:
rip=207.245.39.90, lip=<lip>
dovecot: Dec 10 16:17:03 Info: pop3-login: Disconnected:
rip=207.245.39.90, lip=<lip>
A little later on:
dovecot: Dec 10 16:17:12 Info: pop3-login: Aborted login:
user=<pwitest>, method=PLAIN, rip=207.245.39.90, lip=<lip>
dovecot: Dec 10 16:17:12 Info: pop3-login: Aborted login:
user=<tsinternetuser>, method=PLAIN, rip=207.245.39.90, lip=<lip>
dovecot: Dec 10 16:17:12 Info: pop3-login: Aborted login: user=<bill>,
method=PLAIN, rip=207.245.39.90, lip=<lip>
dovecot: Dec 10 16:17:12 Info: pop3-login: Aborted login: user=<web>,
method=PLAIN, rip=207.245.39.90, lip=<lip>
dovecot: Dec 10 16:17:12 Info: pop3-login: Aborted login:
user=<barbara>, method=PLAIN, rip=207.245.39.90, lip=<lip>
dovecot: Dec 10 16:17:12 Info: pop3-login: Aborted login: user=<www>,
method=PLAIN, rip=207.245.39.90, lip=<lip>
dovecot: Dec 10 16:17:12 Info: pop3-login: Aborted login: user=<user>,
method=PLAIN, rip=207.245.39.90, lip=<lip>
dovecot: Dec 10 16:17:12 Info: pop3-login: Aborted login:
user=<nathan>, method=PLAIN, rip=207.245.39.90, lip=<lip>
dovecot: Dec 10 16:17:12 Info: pop3-login: Aborted login:
user=<webmaster>, method=PLAIN, rip=207.245.39.90, lip=<lip>
etc. etc.
