Symptoms
-
IMAP accounts are failing to sync when using the Outlook mail client.
-
The Postfix service stops sending/receiving emails on port 587.
-
The following error can be found on
/var/log/maillog:postfix/smtpd[12664]: warning: Connection concurrency limit exceeded: 51 from unknown [203.0.113.1] for service smtp
Cause
The maximum number of connections that an SMTP client may make simultaneously is exceeded (default is 50).
Resolution
Either of the following resolutions can be applied:
Increase the number of connections that an SMTP client may make simultaneously:
-
Connect to the server using SSH
-
Execute the command below to increase the maximum number of connections that an SMTP client may make simultaneously:
# postconf smtpd_client_connection_count_limit=100
Note: This is a sample value, it needs to be changed according to the server specifics.
Configure Fail2Ban so that it will automatically block IP addresses that exceeded the allowed limit.
-
Go to Plesk > Tools & Settings > IP Address Banning (Fail2Ban) >Jails > Add Jail
-
Add the following:
Name:
postfix-concurrency
Filter:
postfix-sasl -Postfix SMTP and SASL authentication failures
Action:
iptables-multiport[name="postfix-concurrency", port="smtp,smtps,submission" protocol="tcp"]
Log Path:
/var/log/maillog
Ban Period:
600
The maximum number of failed login attempts:
5
-
Go to Tools & Settings > IP Address Banning (Fail2Ban) >Jails > Manage Filters > Add Filter
-
Add the following:
Name:
postfix-concurrency
Content:
[Definition]
failregex = warning: Connection concurrency limit exceeded: [0-9]+ from S+[<HOST>] for service S+$
ignoreregex = -
Connect to the server using SSH
-
Verify the filter functionality by running the following command:
# fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/postfix-concurrency.local
-
If the configuration is correct you will get a result similar to the one below:
Running tests
Use failregex filter file : postfix-concurrency, basedir: /etc/fail2ban
Use log file : /var/log/maillog
Use encoding : UTF-8
Results
Failregex: 0 total
Ignoreregex: 0 total
with