2

From time to time, my mail server stops sending any new mails. When this happened, I find the below error log,

Jun 22 23:10:18 myserver saslauthd[3967]: DEBUG: auth_pam: pam_authenticate failed: Memory buffer error
Jun 22 23:10:18 myserver saslauthd[3971]: DEBUG: auth_pam: pam_authenticate failed: Memory buffer error
Jun 22 23:10:19 myserver saslauthd[3972]: DEBUG: auth_pam: pam_authenticate failed: Memory buffer error
Jun 22 23:10:19 myserver saslauthd[3968]: DEBUG: auth_pam: pam_authenticate failed: Memory buffer error
Jun 22 23:10:20 myserver saslauthd[3969]: DEBUG: auth_pam: pam_authenticate failed: Memory buffer error
Jun 22 23:10:20 myserver saslauthd[3967]: DEBUG: auth_pam: pam_authenticate failed: Memory buffer error
Jun 22 23:10:21 myserver saslauthd[3971]: DEBUG: auth_pam: pam_authenticate failed: Memory buffer error
Jun 22 23:10:21 myserver saslauthd[3972]: DEBUG: auth_pam: pam_authenticate failed: Memory buffer error
Jun 22 23:10:22 myserver saslauthd[3971]: DEBUG: auth_pam: pam_authenticate failed: Memory buffer error

Every time i have to restart server to work normally again.

I also always find the below repeatitive error log from unknown IP address (I am not sure if it is related or not):

Jun 21 06:48:43 myserver sshd[1687]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=************  user=root
Jun 21 06:48:45 myserver sshd[1708]: Failed password for root from ######## port 60021 ssh2
Jun 21 06:48:47 myserver sshd[1708]: Failed password for root from ######## port 60021 ssh2
Jun 21 06:48:47 myserver sshd[1708]: Received disconnect from #######: 11:  [preauth]
Jun 21 06:48:47 myserver sshd[1708]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=************  user=root
Jun 21 06:48:47 myserver sshd[1730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=************  user=root
Jun 21 06:48:48 myserver sshd[1732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=============  user=root
Jun 21 06:48:48 myserver sshd[1730]: Failed password for root from ************ port 60094 ssh2
Jun 21 06:48:50 myserver sshd[1732]: Failed password for root from ============ port 40613 ssh2
Jun 21 06:48:50 myserver sshd[1730]: Failed password for root from ************ port 60094 ssh2
Jun 21 06:48:50 myserver sshd[1734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=************  user=root
Jun 21 06:48:52 myserver sshd[1736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=************  user=root
Jun 21 06:48:52 myserver sshd[1732]: Failed password for root from ============ port 40613 ssh2
Jun 21 06:48:52 myserver sshd[1730]: Failed password for root from ************ port 60094 ssh2
Jun 21 06:48:52 myserver sshd[1730]: Received disconnect from ***********: 11:  [preauth]
Jun 21 06:48:52 myserver sshd[1730]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=***********  user=root
Jun 21 06:48:52 myserver sshd[1734]: Failed password for root from ######## port 47803 ssh2
Jun 21 06:48:54 myserver sshd[1736]: Failed password for root from ######## port 55371 ssh2
Jun 21 06:48:54 myserver sshd[1732]: Failed password for root from ============ port 40613 ssh2
masegaloeh
  • 18,236
  • 10
  • 57
  • 106
MohammedSimba
  • 369
  • 2
  • 4
  • 15

1 Answers1

1

Thanks to that post's answer: https://askubuntu.com/questions/645036/mail-server-memory-buffer-error

According to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758660 saslauthd stops functioning after some amount of logins (successful and/or failed).

You don't need to restart the whole server, the following is enough: 

service saslauthd restart

You can put that into a crontab.

If a lot of logins originate from the same, malicious IP you can drop request from that IP in the firewall to make saslauthd last longer, e.g. iptables -A INPUT -s 185.29.11.6 -j DROP

Community
  • 1
MohammedSimba
  • 369
  • 2
  • 4
  • 15
  • to reduce AUTH atempts by all kinds of bot-net's you can also try to disable SASL AUTH on port 25 on postfix , let it only secure on smtps or/and subbmission 465 and 587 ports master.cf postfix : smtp inet n - - - - smtpd -o smtpd_sasl_auth_enable=no – Tester Feb 12 '17 at 17:24