[Dovecot] avoiding DoS

[Timo Sirainen]

On Thu, 2009-09-03 at 11:07 -0400, David Halik wrote:
> Dovecot finally wedged silently and without complaint, becoming 
> completely unresponsive. I had to kill -9 it this morning in order to 
> restart the service. 

Hmm. That sounds strange.

> Once possibility I considered was that the dovecot 
> user process limit was reached, but this is set to 1024, and I didn't 
> see any errors or warnings anywhere in the logs.
> 
> login_max_processes_count = 256
> max_mail_processes = 1024

max_mail_processes doesn't matter, because no imap/pop3 processes are
created for failed logins.

> Any suggestions on what I could tweak to prevent this from happening in 
> the future?

login_process_per_connection=no makes it possible to handle a lot more
connections. http://wiki.dovecot.org/LoginProcess
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : http://dovecot.org/pipermail/dovecot/attachments/20090906/58c130f2/attachment.bin