Sporadic Login Failures with various clients

[triplett]

I've been experiencing login failures periodically when checking email that I've never quite been able to explain. Usually, after a few frustrating hours of troubleshooting, everything will suddenly start working again, so I forget about it until next time it happens. It's been happening more frequently in recent weeks, so today after creating and looking at detailed client logs, I am beginning to suspect I may be exceeding the maximum connection limit for mailbox.rollernet.us. When the login failures occur, I notice the following line in the client logs:

3 NO Maximum number of connections from user+IP exceeded (mail_max_userip_connections)

Has the max connections been changed (reduced) recently? Is it low enough that a small number of devices behind a NAT-ed could trigger the limit? If this is the problem, is there anything I can do other than make sure a limited number of devices are monitoring email at one time?

Some background:

1. This only happens on my home connection, never when using mobile devices away from home.
2. My home connection presents a single IP to the world and I have a router between my network and the WAN connection that manages internet access for a modest number of devices.
3. "Modest" with regard to email clients that access Roller Network servers is usually around 3 devices: A few Linux machines (desktop + laptop) running Thunderbird and a few Android devices running K-9 mail. Each are configured to check mail for my personal account and the 'Any User' or catchall account. So at most 3 or 4 devices could be connecting to the same accounts simultaneously.
4. I most often experience login failures with Thunderbird, though I have seen the android clients fail a few times. I suspect the latter just fail silently most of the time and T-bird is just less tolerant to the login failures. T-Bird typically throws up a password dialog. Entering the correct pw results in continued failure and another round of dialogs until T-bird eventually gives up.
5. It's usually just once device at a time that fails (typically Thunderbird when I first start it). I can still successfully check mail from the other clients from the same network and IP. I can also login to Webmail from a browser, so I know the email account itself is active and working.
6. If I turn off WiFi on my mobile devices (so they aren't on my network) and wait awhile, Thunderbird usually connects successfully.

Anyone else seeing this kind of thing?

[Seth]

The concurrent connection count for a given IP+user pair is currently set to 25. I don't remember the last time we increased it, but it's never been decreased. I could try increasing it to 30. The catchall and your personal account would not be counted together; even though they're behind the same IP the account names are different.

Just doing a quick search for the "user+IP exceeded" error message in the raw logs shows 11988 matches for the IP I found for your attempts since log rotation this morning, and 87 for everyone else.

[triplett]

Thanks Seth,

Weird. I've definitely only been running 3 clients today, so 25 concurrent should be enough even if the clients are each establishing several concurrent connections. Thunderbird defaults to 5 per account, haven't yet looked at K-9 Mail on Android. My router shows about 15 total connections to belle.rollernet.us at the moment - a few each from the Android clients and the rest from Thunderbird. Not enough to hit the limit, but Thunderbird may be hammering the server when it starts up which is when I see this. It never happens once all accounts are connected - I can run for days without issue. The problems always happen at Thunderbird startup. I've dropped Thunderbird's cached connection count per server down to 2 just to see what happens. I'll check the Android clients later, but they seem better behaved. Makes me wonder whether established but no longer used connections aren't terminating quickly enough somehow. I'll keep a closer eye on my router the next time this crops up to see whether I notice an unusual amount of concurrent connections.

Thanks for the info.

[triplett]

I think I might have figured it out, thanks to knowing the connection count limit for a given IP+user pair. When viewing current connections at the router, I noticed a large number from one of the Android clients. I took a look at the K-9 Mail documentation and found the following in the "Incoming Server -> Advanced" section (emphasis mine):

Max folders to check with push

K-9 Mail needs to establish one connection for each folder that is checked via Push. This can quickly add up and exceed the number of concurrent connections your mail server allows you to establish. This setting is intended as safety mechanism to limit the number of Push connections regardless of how many folders are configured to be checked via Push.

The first 4 options for this setting are: 5, 10, 25. The device in question was at 25 for some reason - the default seems to be 10. So I set all the accounts (this setting is per account) to the lowest setting of 5. We'll see what happens, but I suspect this will minimize or eliminate the problem.