Issue Continue connections and disconnections from 127.0.0.1

[Chepplesk]

Hello, i have thousands of continue connections and disconnections from 127.0.0.1 on dovecot every 30 seconds...

2021-09-06 13:12:28    dovecot    service=imap, user=info@xxxxxxxx.com, ip=[127.0.0.1]. Disconnected: Logged out rcvd=92, sent=1075
2021-09-06 13:12:28    dovecot    imap-login: Login: user=<info@xxxxxxxx.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=497213, TLS, session=<YbuDuVHLxNB/AAAB>
2021-09-06 13:11:57    dovecot    service=imap, user=info@xxxxxxxx.com, ip=[127.0.0.1]. Disconnected: Logged out rcvd=92, sent=1075
2021-09-06 13:11:57    dovecot    imap-login: Login: user=<info@xxxxxxxx.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=497084, TLS, session=<V9yot1HLbNB/AAAB>
2021-09-06 13:11:28    dovecot    service=imap, user=info@xxxxxxxx.com, ip=[127.0.0.1]. Disconnected: Logged out rcvd=92, sent=1075
2021-09-06 13:11:28    dovecot    imap-login: Login: user=<info@xxxxxxxx.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=497002, TLS, session=<8T7wtVHLINB/AAAB>
2021-09-06 13:10:57    dovecot    service=imap, user=info@xxxxxxxx.com, ip=[127.0.0.1]. Disconnected: Logged out rcvd=92, sent=1075
2021-09-06 13:10:57    dovecot    imap-login: Login: user=<info@xxxxxxxx.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=496898, TLS, session=<n00VtFHLws9/AAAB>
2021-09-06 13:10:28    dovecot    service=imap, user=info@xxxxxxxx.com, ip=[127.0.0.1]. Disconnected: Logged out rcvd=92, sent=1075
2021-09-06 13:10:28    dovecot    imap-login: Login: user=<info@xxxxxxxx.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=496816, TLS, session=<K7FcslHLYM9/AAAB>
2021-09-06 13:09:58    dovecot    service=imap, user=info@xxxxxxxx.com, ip=[127.0.0.1]. Disconnected: Logged out rcvd=429, sent=3928
2021-09-06 13:09:58    dovecot    imap-login: Login: user=<info@xxxxxxxx.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=496728, TLS, session=<XNGTsFHL9s5/AAAB>
2021-09-06 13:09:57    dovecot    service=imap, user=info@xxxxxxxx.com, ip=[127.0.0.1]. Disconnected: Logged out rcvd=378, sent=1331
2021-09-06 13:09:57    dovecot    imap-login: Login: user=<info@xxxxxxxx.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=496726, TLS, session=<BamBsFHL7M5/AAAB>

What can it be? Thanks

 

[Kaspar]

Likely webmail

 

[Chepplesk]

Likely webmail

So what can I do?

 

[Kaspar]

Do you have fail2ban enabled?

 

[Chepplesk]

Yes

 

[Kaspar]

Are the log entries all for the same mailbox info@xxxxxxxx.com?

 

[Chepplesk]

Are the log entries all for the same mailbox info@xxxxxxxx.com?

Exactly. They only concern that mailbox.

 

[mow]

And info@ is logged in via webmail?

 

[Kaspar]

In that case my earlier assumption that it was caused by webmail might be incorrect. I suspect there might be a (local) script running that connects to the mailbox every 30 seconds. Are you the owner of the mailbox? If not you could ask the account owner or mailbox user to increase the connection time for the script.

I am not sure if there are any dovecot options to limit the number logins per user.

 

[mow]

Is some kind of CRM or ticketing system running on the server? E.g. Salesforce, Odoo, OTRS, Jira ..?

 

[Chepplesk]

And info@ is logged in via webmail?

Issue also occurs when info@ isn't logged in webmail (night, weekend, etc.)

 

[Chepplesk]

In that case my earlier assumption it was due to webmail might be incorrect. I suspect there might be a (local) script running that connects to the mailbox every 30 seconds. Are you the owner of the mailbox? If not you could ask the account owner or mailbox user to increase the connection time for the script.

I am not sure if there are any dovecot options to limit the number logins per user.

I'm the owner of entire web server. Where would the script in question be? Thanks for the replies

 

[Chepplesk]

Is some kind of CRM or ticketing system running on the server? E.g. Salesforce, Odoo, OTRS, Jira ..?

No. Only WP websites.

 

[mow]

I'm the owner of entire web server. Where would the script in question be? Thanks for the replies

• Check the cron jobs. Both system and wordpress.
• Change the password, wait and see what breaks / who comes complaining

 

[Tim Dondorp]

I am sorry to hijack this topic after such a long time, but I have exactly the same problem. I managed to login at webmail (webmail.xxxx.nl), but as soon as I am logged in my var/log/maillog keeps giving errors like:

2023-04-19 00:01:37	INFO	dovecot [170136]	service=imap, user=info@xxxx.nl, ip=[127.0.0.1]. Disconnected: Logged out rcvd=261, sent=1150
2023-04-19 00:01:37	INFO	dovecot [170136]	imap-login: Login: user=<info@xxxx.nl>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=173161, TLS, session=<as+Sc6P5Vql/AAAB>
2023-04-19 00:01:36	INFO	dovecot [170136]	service=imap, user=info@xxxx.nl, ip=[127.0.0.1]. Disconnected: Logged out rcvd=76, sent=622
2023-04-19 00:01:36	INFO	dovecot [170136]	imap-login: Login: user=<info@xxxx.nl>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=173159, TLS, session=<l26Dc6P5Tql/AAAB>
2023-04-19 00:01:35	INFO	dovecot [170136]	service=imap, user=info@xxxx.nl, ip=[127.0.0.1]. Disconnected: Logged out rcvd=130, sent=872
2023-04-19 00:01:35	INFO	dovecot [170136]	imap-login: Login: user=<info@xxxx.nl>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=173157, TLS, session=<njF0c6P5Pql/AAAB>
2023-04-19 00:01:35	INFO	dovecot [170136]	service=imap, user=info@xxxx.nl, ip=[127.0.0.1]. Disconnected: Logged out rcvd=74, sent=733
2023-04-19 00:01:35	INFO	dovecot [170136]	imap-login: Login: user=<info@xxxx.nl>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=173155, TLS, session=<jnRwc6P5Lql/AAAB>

As soon as I log off from webmail this stops. Now I only have one mailbox on my server, but the same happens when I test other temporarily made email boxes. I am sure my hostname is correct, there are now cronjobs and my dns records are correct. Did you manage to solve this problem?

 

[Peter Debik]

@Tim Dondorp , please check the refresh frequency that has been configured in Webmail. Some users configure that to 1 second, so that webmail continuosly has to query Dovecot for new mail.

 

[Kaspar]

I am sorry to hijack this topic after such a long time, but I have exactly the same problem. I managed to login at webmail (webmail.xxxx.nl), but as soon as I am logged in my var/log/maillog keeps giving errors like:
[...]
As soon as I log off from webmail this stops. Now I only have one mailbox on my server, but the same happens when I test other temporarily made email boxes. I am sure my hostname is correct, there are now cronjobs and my dns records are correct. Did you manage to solve this problem?

Those are not errors, just normal log entries. Every time a connection gets made to the mail server those connections get logged. Webmail connects via IMAP when you login, so those connections get logged too. Perfectly normal behaviour.