[Dovecot] testing LDAP connections
Hello all,
I haven't looked into the source code, but i suspect that LDAP connections, once established, are not tested properly.
My scenario is the followind:
Dovecot server <--------> firewall <---------> LDAP backend
What happens is that the firewall has a security feature which
basically make de firewall box "forget" about connections that are idle for more than X period of time. That particular setting is 30 minutes right now. When that happens, neither the LDAP backend or the Dovecot server get any type of notification, and for all they care the connection is alive and well. This is a very common implementation in firewalls nowadays.
So my question is, is there any way to make dovecot re-open a new
connection if there is a timeout while trying to use a connection already opened? I believe that this could be of great benefit for those who don't have their servers on the same physical network.
Thanks in advance,
Hugo Monteiro.
-- ci.fct.unl.pt:~# cat .signature
Hugo Monteiro Email : hugo.monteiro@fct.unl.pt Telefone : +351 212948300 Ext.15307
Centro de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.ci.fct.unl.pt apoio@fct.unl.pt
ci.fct.unl.pt:~# _
On Mon, 2007-04-02 at 14:48 +0100, Hugo Monteiro wrote:
So my question is, is there any way to make dovecot re-open a new
connection if there is a timeout while trying to use a connection already opened? I believe that this could be of great benefit for those who don't have their servers on the same physical network.
So, as discussed in IRC for now there's this patch: http://dovecot.org/patches/ldap-timeout.diff
I'm not sure if for v1.1 I should add that with the timeout configurable in dovecot-ldap.conf (and same for SQL), or do something else such as sending some dummy request to the LDAP server. Or alternative to a "check once a second timeout" would be to check it only when the next request arrives, and then do the reconnection. That'll of course slow down that authentication a bit.
participants (2)
-
Hugo Monteiro
-
Timo Sirainen