<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
Check your /var/log/maillog and /var/log/secure files. Your server may be under attack. That's the same symptoms you get when someone is trying to guess user passwords with POP3.
<br />
<br />You can also detect it by looking at "netstat -na | more" for a lot of port 110 connections coming from the same remote IP address. And look at "ps ax | more" for a lot of "POP login" entries and "dovecot-auth" entries. Either one will indicate a lot of POP authentication attempts, and enough of them fast enough will break the authentication mechanism.
<br />
<br />If you do detect a attach, the first thing is to lock them out. Use the firewall rule "iptables -I acctin 1 -s x.x.x.x/32 -j DROP" (replace the x.x.x.x with the IP of the attacker found in the logs or netstat output). That will lock out that IP and end the attack. That rule will go away the next time you reboot - but that's usually long enough for the script kiddies to move on to other targets.
<br />
<br />After locking out a attacker, use the following commands to reset your POP and SMTP services:
<br />service sendmail stop
<br />service dovecot stop
<br />killall -9 sendmail
<br />killall -9 dovecot-auth
<br />killall -9 pop3-login
<br />service dbrecover stop
<br />service auditd restart
<br />service dbrecover start
<br />service saslauthd restart
<br />service dovecot start
<br />service sendmail start
<br />
<br />That should reset all services needed and get your users back in for their e-mail.
<br />
<br />
<br />
<br />Chuck
<br />
<br />
<br />
<br /><font size="2"><b>---------- Original Message
-----------</b>
<br />
From: "Michael Aronoff" <maronoff@gmail.com>
<br />
To: "BlueOnyx General Mailing List" <blueonyx@blueonyx.it>
<br />
Sent: Wed, 11 Apr 2012 10:28:16 -0700
<br />
Subject: [BlueOnyx:10113] Dovecot error
<br />
<br />> I am getting strange errors on just a couple of users when they try to
check mail.<o:p />
<br />> <o:p> </o:p>
<br />> In the logs I
see:<o:p />
<br />> Apr 11 09:15:26 tc auth: pam_succeed_if(dovecot:auth):
error retrieving information about user aqua<o:p />
<br />> <o:p>
</o:p>
<br />> If I reboot they can then check email for a
while.<o:p />
<br />> <o:p> </o:p>
<br />> Has anyone seen
this?<o:p />
<br />> <o:p> </o:p>
<br />> <span style="font-size: 10pt; font-family: "Tahoma","sans-serif"; color: black;">M
Aronoff</span><o:p />
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>