Login with wrong credentials slow due delay on Dovecot

[drdol]

Introduced in ​Changeset 4122 (line 706), the code will loop over $auth_methods and will do count($auth_methods)-login attempts.
The IMAP connection look like:

A0001 ID (name "Roundcube Webmail" version 0.5.1 php 5.2.6-3 os Linux command /)
A0002 AUTHENTICATE PLAIN BASE64ENCODING
A0003 LOGIN mail@example.com password
A0004 LOGOUT

If the IMAP-Server supports "AUTHENTICATE PLAIN", Roundcube tries to login twice, if the login credentials are incorrect. First using "AUTHENTICATE PLAIN" and "LOGIN" as a second attempt.
In older version of Roundcube, only "LOGIN" was supported.

The double check if the credentials cause some problems if Dovecot is in use. Dovecot will delay login with wrong credentials. This is mentioned ​here. Mentioned in the mailinglist, every wrong login attempt will increase the delay.

This delay has a negative impact for a user. The user sometimes has to wait 15 - 20 seconds to determine, that the user credentials are wrong, due the delay of the second login attempt with "LOGIN". IHMO after the first login failing the script should skip further tries to avoid delays.
The delay even increase, if to much wrong login attempts coming from the same IP.

[alec]

You can set imap_auth_type.

[drdol]

Sorry, the link to the Dovecot mailinglist is wrong. Correct link is: ​Dovecot Auth failure delays

@alec: Thx, I will give it a try.

[alec]

Fixed in [ab0b51a1].

[drdol]

@alec: Thanx for the quick fix. It works as exacted.

[mceccarellitnx]

I modify this ticket because i found a problem that we have pached.
Debugging fail login we have found a 5 second delay in rcube_imap_generic.php closeConnection().
At the end of authentication process RC call closeConnection and in closeConnection try to send the LOGOUT command to the imap server but in the case the user is not logged in this cause a 5 second delay (in our configuration with dovecot)

Original closeConnection (in rcube_imap_generic.php):

    function closeConnection()
    {
        if ($this->putLine($this->nextTag() . ' LOGOUT')) {
            $this->readReply();
        }

        $this->closeSocket();
    }

Patched closeConnection:

    function closeConnection()
    {
        if ($this->logged) {
            if ($this->putLine($this->nextTag() . ' LOGOUT')) {
                $this->readReply();
            }
        }
        $this->closeSocket();
    }

[alec]

Good catch, but you should open a new ticket. Fixed in 18372a236d459f2a098c8604a0f912f9aa728f98