Description of problem: After pam_tally have been setup for a system (e.g. http://kbase.redhat.com/faq/FAQ_103_12548.shtm ) and cyrus-imapd is running and using PAM as authentication system, we found that cyrus-imapd would failed to work after about 1500 POP3 email checking. And it would work again after we restart the saslauthd. From the lsof result, we can see that there are many unclosed file handlers to /var/log/faillog holding by saslauthd, which should be opened by pam_tally.so. And in /var/log/secure there are a lot of the following message: Jul 29 14:32:12 rhel5-1 saslauthd[19496]: PAM unable to dlopen(/lib/security/$ISA/pam_env.so) Jul 29 14:32:12 rhel5-1 saslauthd[19496]: PAM [error: /lib/security/../../lib/security/pam_env.so: cannot open shared object file: Too many open files] Jul 29 14:32:12 rhel5-1 saslauthd[19496]: PAM adding faulty module: /lib/security/$ISA/pam_env.so Version-Release number of selected component (if applicable): pam-0.99.6.2-3.27.el5 How reproducible: Always Steps to Reproduce: 1. Add pam_tally.so to system-auth (no "deny=" is set) 2. Setup cyrus-imapd as a POP3 email server 3. Login and out the server for about 1500 times Actual results: Cannot login the server anymore Expected results: Can login the server Additional info: I studied the source code and it seems like a file handler is not closed in the "tally_check" function, which is opened by the "get_tally" function.
Created attachment 312854 [details] Patch for the unclosed file handler
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux maintenance release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Update release for currently deployed products. This request is not yet committed for inclusion in an Update release.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2009-0222.html