[Dovecot] v1.1 max connections per user
v1.1 has now:
# Maximum number of connections allowed for a user. The limits are enforced # separately for IMAP and POP3 connections, so you can move this setting # inside protocol {} to have separate settings for them. NOTE: The user names # are compared case-sensitively, so make sure your userdb returns usernames # always using the same casing so users can't bypass this limit! #mail_max_user_connections = 10
Is 10 a good default?
Currently new connections just fail authentication with a "Maximum number of connections exceeded" error message. v2.0 hopefully will instead disconnect the oldest idling connection with IMAP.
Timo Sirainen, on 6/30/2007 6:43 PM, said the following:
v1.1 has now:
# Maximum number of connections allowed for a user. The limits are enforced # separately for IMAP and POP3 connections, so you can move this setting # inside protocol {} to have separate settings for them. NOTE: The user names # are compared case-sensitively, so make sure your userdb returns usernames # always using the same casing so users can't bypass this limit! #mail_max_user_connections = 10
Is 10 a good default?
I'm assuming this is per IP?
In Courier, there were two settings:
MAXDAEMONS = 40 (total number of IMAP connections the server would accept) and MAXPERIP = 4 (number of connections per IP)
The values above were the defaults.
I think it would be a good thing to have both, *and* to allow for setting the MAXPERIP on both a per user and global basis (if a per user value is not provided it uses the global default).
Later, adding the ability to set them both on a per domain basis, and the MAXPERIP on a per domain/user basis would be even better...
Currently new connections just fail authentication with a "Maximum number of connections exceeded" error message. v2.0 hopefully will instead disconnect the oldest idling connection with IMAP.
Very sensible - much better than just refusing the connection...
--
Best regards,
Charles
On Sat, 2007-06-30 at 19:11 -0400, Charles Marcus wrote:
Timo Sirainen, on 6/30/2007 6:43 PM, said the following:
v1.1 has now:
# Maximum number of connections allowed for a user. The limits are enforced # separately for IMAP and POP3 connections, so you can move this setting # inside protocol {} to have separate settings for them. NOTE: The user names # are compared case-sensitively, so make sure your userdb returns usernames # always using the same casing so users can't bypass this limit! #mail_max_user_connections = 10
Is 10 a good default?
I'm assuming this is per IP?
No. I'm not sure if it should. Perhaps. It's mostly intended to prevent unintentional abuse by stupid clients, so having 3+ thunderbirds open in different locations with each having 5 connections should probably be allowed.
In Courier, there were two settings:
MAXDAEMONS = 40 (total number of IMAP connections the server would accept)
Dovecot has max_mail_processes defaulting to 1024.
I think it would be a good thing to have both, *and* to allow for setting the MAXPERIP on both a per user and global basis (if a per user value is not provided it uses the global default).
Later, adding the ability to set them both on a per domain basis, and the MAXPERIP on a per domain/user basis would be even better...
All of these seem to be for handling intentional abuse. v2.0 maybe.
Timo Sirainen, on 6/30/2007 7:25 PM, said the following:
On Sat, 2007-06-30 at 19:11 -0400, Charles Marcus wrote:
Timo Sirainen, on 6/30/2007 6:43 PM, said the following:
v1.1 has now:
# Maximum number of connections allowed for a user. The limits are enforced # separately for IMAP and POP3 connections, so you can move this setting # inside protocol {} to have separate settings for them. NOTE: The user names # are compared case-sensitively, so make sure your userdb returns usernames # always using the same casing so users can't bypass this limit! #mail_max_user_connections = 10
Is 10 a good default? I'm assuming this is per IP?
No. I'm not sure if it should. Perhaps. It's mostly intended to prevent unintentional abuse by stupid clients, so having 3+ thunderbirds open in different locations with each having 5 connections should probably be allowed.
Ok - you said 10 was the default - but then said that 15 (3 TBirds x 5) connections should be allowed, which is more than 10... so... you just meant that one could accommodate that by upping this limit to 15?
In Courier, there were two settings:
MAXDAEMONS = 40 (total number of IMAP connections the server would accept)
Dovecot has max_mail_processes defaulting to 1024.
Ahhh... ok - but is that configurable? For smaller shops, I'd definitely want to be able to set it to a much lower value (one of my courier clients that I'm still trying to convince to upgrade to dovecot - I have more than a few of those it seems, including my primary client that I'm writing this from - I have MAXDAEMONS set to 75).
I think it would be a good thing to have both, *and* to allow for setting the MAXPERIP on both a per user and global basis (if a per user value is not provided it uses the global default).
Later, adding the ability to set them both on a per domain basis, and the MAXPERIP on a per domain/user basis would be even better...
All of these seem to be for handling intentional abuse. v2.0 maybe.
Definitely for handling abuse, but sometimes said abuse could be unintentional... ;)
This definitely falls into the 'it would be nice' category, so v2.0+ target is fine by me...
--
Best regards,
Charles
On 2007-07-01 01:25, Timo Sirainen wrote:
On Sat, 2007-06-30 at 19:11 -0400, Charles Marcus wrote:
I'm assuming this is per IP?
No. I'm not sure if it should. Perhaps.
If you think about it, also take NATed networks into account. So it would need a fairly high default and should have a remark in the comment to make admins aware.
Jürgen
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Sun, 1 Jul 2007, Jürgen Herz wrote:
If you think about it, also take NATed networks into account. So it would need a fairly high default and should have a remark in the comment to make admins aware.
Yep!
A limit per IP is not enforcable in my mind. Perhaps if you can exclude some IPs.
Donnu, but I wouldn't enable a connection limit by default. Let the admin choose a correct value after "QuickStart" went well.
Bye,
Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBRojwTC9SORjhbDpvAQL9RQf+Jc4ej0FjBlYxEtLf927iR6JFkG542SIy ustG06SoxXrJCVRJGNFO4u3yZLDcfH3eRF/agSkgxWRykVoD3B3BpEP2ivNDAOYR vKgVgdBH2eXbIq0a7jK0DPlTAyq9RUqtu8SX48lLB3ysnAzUfY20uBcMAlJUCPwR XcLiGkbLpygdtqXgvLi4+1W0zL2xFBZOXO+MVQ3dGADXQqy4Sgahx4hm6zvAIGEe Gy1LfFeFOhluh3eeyMwh8NBj8jTPTxcKhMNUeRltK7VXfs8/eGjAZ/56uNWLS7l+ tYDPmeU5shVSs+ucNinrk+b83ctYyTOU2kTVYbxGnjW0wSzK9o1n5g== =ltiB -----END PGP SIGNATURE-----
On Mon, 2 Jul 2007 14:32:11 +0200 (CEST) Steffen Kaiser skdovecot@smail.inf.fh-bonn-rhein-sieg.de wrote:
Donnu, but I wouldn't enable a connection limit by default. Let the admin choose a correct value after "QuickStart" went well.
Agreed.
A per IP limit that defaults to something other than UNLIMITED and which might sneak into the system/config under the radar with 1.1 would happily break things here (all connections come from the proxy). A per user (login id) one might still affect things in an unexpected manner if uncaught in the upgrade, but at least w/o a such a totally devastating effect as with a per IP one.
My 2 yen,
Christian
Christian Balzer Network/Systems Engineer NOC chibi@gol.com Global OnLine Japan/Fusion Network Services http://www.gol.com/
On Sun, 2007-07-01 at 01:43 +0300, Timo Sirainen wrote:
#mail_max_user_connections = 10
Changed:
protocol imap { # Maximum number of IMAP connections allowed for a user from each IP address. # NOTE: The username is compared compared case-sensitively. #mail_max_userip_connections = 10 }
protocol pop3 { # Maximum number of POP3 connections allowed for a user from each IP address. # NOTE: The username is compared compared case-sensitively. #mail_max_userip_connections = 3 }
participants (5)
-
Charles Marcus
-
Christian Balzer
-
Jürgen Herz
-
Steffen Kaiser
-
Timo Sirainen