Re: Bad logins bogging down server

Dan White <[email protected]>
Newsgroups gmane.mail.imap.cyrus
Message-ID <[email protected]>
On 09/19/17 09:52 -0400, Michael Sofka wrote:
>The botnet is still hammering away, checking those old accounts.  But 
>the bottleneck appears to have been saslauthd threads.  Doubling the 
>thread count from 5 to 10 has resolved the problem for now.  (And, 

If you're comfortable with caching, increase the -t value to saslauthd.

>On 09/16/2017 07:41 AM, Michael D. Sofka wrote:
>>The symptoms are that connections grow, and grow and grow until 
>>authentication slows, holding open connections longer and longer.  
>>It takes about 15 minutes for the connection number to be at a point 
>>at which service is interrupted.  Friday night at attempt was made 
>>to re-enable off-campus IMAP, and the bots were still at it, service 
>>was again disrupted.

>>Any other resources or limits in either Cyrus or Linux (Debian) that 
>>I should look at?

https://debian-administration.org/article/187/Using_iptables_to_rate-limit_incoming_connections

-- 
Dan White
----
Cyrus Home Page: http://www.cyrusimap.org/
List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
To Unsubscribe:
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.