Results 1 to 3 of 3

Hybrid View

  1. #1
    Join Date
    Jan 2006
    Posts
    30

    Dovecot; multiple pop3-login processes.

    Hi.

    I am running dovecot & centOS. Everything seemed to be running fine for the first couple of months, but about 2 months ago I noticed there were 200 processes running (in top) instead of the usual 101 or so. I found the 100 extra were called 'pop3-login' I restarted dovecot, and it went back down to 3. Every few days it seems to go back up, and I just restart it.

    It would be great if somebody knew what was going on? I cant seem to find anything on google. Appart from add /etc/init.d/dovecot restart to the crontab, im not sure what to do.

    Any ideas?
    Thanks.
    Carl.

  2. #2
    Join Date
    Apr 2004
    Location
    SF Bay Area
    Posts
    879
    Quote Originally Posted by Carlton
    Hi.
    It would be great if somebody knew what was going on? I cant seem to find anything on google. Appart from add /etc/init.d/dovecot restart to the crontab, im not sure what to do.
    I'll put my money on a brute force POP3 DDoS attack.

    You might look at something simple like APF to mitigate DDOS attacks.

  3. #3
    Join Date
    Jan 2006
    Posts
    30
    Hi.
    Are there any logs to check for failed logins to see if this is the case? Does every process mean someone is trying to login at that moment in time? Or perhaps have logged in but closed the connection before loging out?
    Thanks.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •