Dovecot (IMAP) keeps failing

Operating System & Version
CloudLinux 7.9
cPanel & WHM Version
94.0.15
I

Inna

Active Member
Mar 10, 2018
41
6
58
Iran
cPanel Access Level
Root Administrator
Hi,

It's about four days I think that Dovecot keeps failing and then running multiple times. This is the log I see in email:

Code: 
Reason    TCP Transaction Log:

<< * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE NAMESPACE LITERAL+ STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready.

>> A001 LOGIN __cpanel__service__auth__imap__59dhcadQbvagiIfK JnCfIgLph4RRSWam

<< A001 NO [UNAVAILABLE] Temporary authentication failure. [hostname.com:2021-08-16 09:02:01]

imap: ** [A001 NO [UNAVAILABLE] Temporary authentication failure. [hostname.com:2021-08-16 09:02:01] != A001 OK]

: Died

Number of Restart Attempts    2

Service Check Raw Output    The 'dovecot' service passed the check: dovecot (/usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf) is running as root with PID 1053893 (systemd+/proc check method).

And this is the log when I run /scripts/restartsrv_dovecot --stop and /scripts/restartsrv_dovecot --start as said here:

Code: 
[root@hostname ~]# /scripts/restartsrv_dovecot --stop

Waiting for “dovecot” to stop ………finished.

Startup Log

    Aug 16 13:35:22 hostname.com dovecot_cpshutdown[1057065]: Opened “/var/run/dovecot/master.pid” …

    Aug 16 13:35:22 hostname.com dovecot_cpshutdown[1057065]: Master Dovecot process = 1055870

    Aug 16 13:35:22 hostname.com dovecot_cpshutdown[1057065]: Executing “/usr/sbin/dovecot stop” …

    Aug 16 13:35:22 hostname.com dovecot[1055870]: master: Warning: Killed with signal 15 (by pid=1057066 uid=0 code=kill)

    Aug 16 13:35:23 hostname.com dovecot_cpshutdown[1057065]: Waiting 30 seconds for process 1057066 to end …

    Aug 16 13:35:23 hostname.com dovecot_cpshutdown[1057065]: Done! Waiting 30 seconds for process 1055870 to end …

    Aug 16 13:35:23 hostname.com dovecot_cpshutdown[1057065]: Dovecot is now shut down.

    Aug 16 13:35:23 hostname.com dovecot_cpshutdown[1057065]: Any remaining Dovecot processes will now be terminated.

    Aug 16 13:35:24 hostname.com dovecot_cpshutdown[1057065]: Waiting for dovecot,dovecot-auth,dovecot/pop3-login,dovecot/imap-login,dovecot/anvil,dovecot/log,dovecot/config,dovecot/auth,dovecot-wrap to shutdown ... not running.

    Aug 16 13:35:24 hostname.com systemd[1]: Stopped Dovecot Imap Server.



Log Messages

    Aug 16 13:35:22 hostname dovecot: master: Warning: Killed with signal 15 (by pid=1057066 uid=0 code=kill)

    Aug 16 13:32:28 hostname dovecot: master: Dovecot v2.3.13 (89f716dc2) starting up for lmtp, imap, pop3 (core dumps disabled)

    Aug 16 13:32:16 hostname dovecot: master: Warning: Killed with signal 15 (by pid=1055812 uid=0 code=kill)

    Aug 16 13:32:16 hostname dovecot: imap-login: Disconnected (auth service reported temporary failure): user=<__cpanel__service__auth__imap__59dhcadqbvagiifk>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<r9AqdKnJKKx/AAAB>

    Aug 16 13:31:59 hostname dovecot: auth-worker(1055687): Error: conn unix:auth-worker (pid=1053906,uid=97): auth-worker<1>: dict(__cpanel__service__auth__imap__59dhcadqbvagiifk,127.0.0.1,<r9AqdKnJKKx/AAAB>): Failed to lookup key shared/dovecot_userdb-imap/__cpanel__service__auth__imap__59dhcadqbvagiifk: Connection closed: read(size=8192) failed: Connection reset by peer (reply took 0.002 secs (0.003 in dict wait, 0.000 in other ioloops, 0.000 in locks))

dovecot stopped successfully.

[root@hostname ~]# /scripts/restartsrv_dovecot --start

Waiting for “dovecot” to start ……waiting for “dovecot” to initialize ………finished.

Service Status

    dovecot (/usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf) is running as root with PID 1057078 (systemd+/proc check method).

Startup Log

    Aug 16 13:35:24 hostname.com systemd[1]: Started Dovecot Imap Server.

    Aug 16 13:35:24 hostname.com dovecot[1057078]: master: Dovecot v2.3.13 (89f716dc2) starting up for lmtp, imap, pop3 (core dumps disabled)

Log Messages

    Aug 16 13:35:24 hostname dovecot: master: Dovecot v2.3.13 (89f716dc2) starting up for lmtp, imap, pop3 (core dumps disabled)

    Aug 16 13:35:22 hostname dovecot: master: Warning: Killed with signal 15 (by pid=1057066 uid=0 code=kill)

    Aug 16 13:32:28 hostname dovecot: master: Dovecot v2.3.13 (89f716dc2) starting up for lmtp, imap, pop3 (core dumps disabled)

    Aug 16 13:32:16 hostname dovecot: master: Warning: Killed with signal 15 (by pid=1055812 uid=0 code=kill)

    Aug 16 13:32:16 hostname dovecot: imap-login: Disconnected (auth service reported temporary failure): user=<__cpanel__service__auth__imap__59dhcadqbvagiifk>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<r9AqdKnJKKx/AAAB>

dovecot started successfully.

This is /var/log/maillog:

Code: 
Aug 16 13:37:01 hostname spamd[595283]: spamd: connection from localhost [::1]:57968 to port 783, fd 5
Aug 16 13:37:02 hostname dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<pPM6hqnJqpl/AAAB>
Aug 16 13:37:02 hostname dovecot: lmtp(1057508): Connect from local
Aug 16 13:37:02 hostname dovecot: lmtp(1057508): Disconnect from local: Client has quit the connection (state=READY)
Aug 16 13:37:03 hostname dovecot: auth-worker(1057516): Error: conn unix:auth-worker (pid=1057088,uid=97): auth-worker<1>: dict(__cpanel__service__auth__imap__59dhcadqbvagiifk,127.0.0.1,<8xNLhqnJvKx/AAAB>): Failed to lookup key shared/dovecot_userdb-imap/__cpanel__service__auth__imap__59dhcadqbvagiifk: Connection closed: read(size=8192) failed: Connection reset by peer (reply took 0.007 secs (0.002 in dict wait, 0.000 in other ioloops, 0.000 in locks))
Aug 16 13:37:20 hostname dovecot: imap-login: Disconnected (auth service reported temporary failure): user=<__cpanel__service__auth__imap__59dhcadqbvagiifk>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<8xNLhqnJvKx/AAAB>
Aug 16 13:37:20 hostname dovecot: master: Warning: Killed with signal 15 (by pid=1057600 uid=0 code=kill)
Aug 16 13:37:22 hostname dovecot: master: Dovecot v2.3.13 (89f716dc2) starting up for lmtp, imap, pop3 (core dumps disabled)
Aug 16 13:42:03 hostname spamd[595283]: spamd: connection from localhost [::1]:58110 to port 783, fd 5
Aug 16 13:42:03 hostname dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<SAcumKnJNpp/AAAB>
Aug 16 13:42:04 hostname dovecot: lmtp(1059308): Connect from local
Aug 16 13:42:04 hostname dovecot: lmtp(1059308): Disconnect from local: Client has quit the connection (state=READY)
Aug 16 13:42:04 hostname dovecot: auth-worker(1059315): Error: conn unix:auth-worker (pid=1057630,uid=97): auth-worker<1>: dict(__cpanel__service__auth__imap__59dhcadqbvagiifk,127.0.0.1,<kkE+mKnJRK1/AAAB>): Failed to lookup key shared/dovecot_userdb-imap/__cpanel__service__auth__imap__59dhcadqbvagiifk: Connection closed: read(size=8192) failed: Connection reset by peer (reply took 0.002 secs (0.001 in dict wait, 0.000 in other ioloops, 0.000 in locks))
Aug 16 13:42:21 hostname dovecot: imap-login: Disconnected (auth service reported temporary failure): user=<__cpanel__service__auth__imap__59dhcadqbvagiifk>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<kkE+mKnJRK1/AAAB>
Aug 16 13:42:21 hostname dovecot: master: Warning: Killed with signal 15 (by pid=1059401 uid=0 code=kill)
Aug 16 13:42:24 hostname dovecot: master: Dovecot v2.3.13 (89f716dc2) starting up for lmtp, imap, pop3 (core dumps disabled)

How to solve this? And how to see what is the cause of this issue?

 
kodeslogic

kodeslogic

Well-Known Member
PartnerNOC
Apr 26, 2020
576
266
138
IN
cPanel Access Level
Root Administrator
Try to force update from the command line, it may resolve this issue:

Code: 
/scripts/upcp --force
 
  • Like
Reactions: Inna
cPRex

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
16,570
2,612
363
cPanel Access Level
Root Administrator
Forcing a server update is never a bad idea, as it wouldn't hurt anything. I do have many tickets in the past with various authentication failures, but usually those are associated with a specific user trying to log in to the machine, and not just a restart of the process.

If you still see the issues after an update it might be best to submit a ticket to our team so we can check this out directly on the system. If you decide to submit a ticket, please post the number here so I can follow along on my end and make sure this thread stays updated.
 
  • Like
Reactions: Inna
I

Inna

Active Member
Mar 10, 2018
41
6
58
Iran
cPanel Access Level
Root Administrator
kodeslogic said:
Try to force update from the command line, it may resolve this issue:
Thanks, updating fixed the issue:)
Code: 
/scripts/upcp --force
Click to expand...
cPRex said:
Forcing a server update is never a bad idea, as it wouldn't hurt anything. I do have many tickets in the past with various authentication failures, but usually those are associated with a specific user trying to log in to the machine, and not just a restart of the process.

If you still see the issues after an update it might be best to submit a ticket to our team so we can check this out directly on the system. If you decide to submit a ticket, please post the number here so I can follow along on my end and make sure this thread stays updated.
Click to expand...
Updating fixed it, but I've been tailing the log files and saw no users trying to log in or there were no attacks or such things.

I'm not sure why, but I'm glad it's fixed.
 
kodeslogic

kodeslogic

Well-Known Member
PartnerNOC
Apr 26, 2020
576
266
138
IN
cPanel Access Level
Root Administrator
I am glad I was able to help.
 
  • Like
Reactions: Inna and cPRex
You must log in or register to reply here.
Thread starter Similar threads Forum Replies Date
R Can't login to Dovecot during distributed imap login attack Email 2
M SOLVED Dovecot Imap: Warning: fd limit (ulimit -n) is lower than required under max Email 6
U Problem with dovecot/imap Email 1
P dovecot master user implementation for imap migration Email 11
B [Case 54362] CPHulk vs Dovecot / IMAP Email 11
Similar threads
Can't login to Dovecot during distributed imap login attack
SOLVED Dovecot Imap: Warning: fd limit (ulimit -n) is lower than required under max
Problem with dovecot/imap
dovecot master user implementation for imap migration
[Case 54362] CPHulk vs Dovecot / IMAP
Top Bottom