Subject: Our POP server "hangs"

From: "haim [howard] roman" <[email-masked]>
Date: Wed, 08 Dec 2004 14:46:30 +0200

We're running UW's ipop3d.  This week, it often happens that users 
cannot retrieve mail.  Sometimes rebooting their station (MS Windows) 
helps, sometimes not.  When rebooting doesn't help, we kill all the 
ipop3d processes; that usually helps.

Does anyone have any ideas?  I searched the c-client mailing list 
archives, but I could not find anything.

Here are  more pieces of information:

(1) Our ipop3d version is v2003.83.

(2) The OS is Red Hat Linux release 9 (Shrike), running on Intel.

(3) Sometimes, we might be having too many POP sessions at once.

    (A) We sometimes see the following message:

            xinetd[2586]: FAIL: pop3s service_limit from=212.235.0.88

        That indicates too many concurrent sessions for that service.

    (B) For POP & IMAP, we changed from 60 (xinetd's default) to 200.

    (C) However, we've experienced this problem of users not getting
        mail even when there are far fewer than 60 processes.

(4) Very often, I see many ipop3d processes, *all* of which are owned
    by root. 

    (A) The ipop3d is supposed to change its UID (or EUID)
        to the user who initiated the session.

    (B) This might be due to a lot of failed logins to POP.  However,
        why are the processes staying around?

(5) Most of our users user mail clients on MS Windows, usually
    Outlook or Outlook Express, sometimes Mozilla or Thunderbird.

(6) I'm not aware of any problem with our IMAP server.  However, there
    are far fewer of them, and most of them probably use webmail.

Thanks, 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Haim (Howard) Roman     |  Computer Center
[email-masked]         |  Jerusalem College of Technology,  ISRAEL

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Wed, 8 Dec 2004 10:43:08 -0800 (PST)

Your reported symptoms look very much like [x]inetd is throttling the 
server port due to too many simultaneous connections.  I suggest that you 
use the netstat program to see if you can find a particular IP address or 
addresses which is attempting an excessive number of connections, and 
remedy that.

Since your Linux system uses PAM for authentication, there may also be an 
overload of the PAM facility.

It's probably accidental; but in effect you have a denial-of-service 
attack going on.  You need to find the responsible machine and put a stop 
to it.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.