<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>You might as well consider something slightly more fresh. 2.2.10
is rather old already.</p>
<p>And you should also turn on consistent hashing option.</p>
<p>I'd recommend putting dovecot as proxy in front of the directors,
and do any brute force deterring there. You can use e.g.
weakforced here if you are using 2.2.27+, but dovecot already does
some deterring by stalling failed logins.</p>
<p>Dovecot always does asynchronous logins, as the imap-login and
auth process are separate.<br>
</p>
Aki<br>
<br>
<div class="moz-cite-prefix">On 26.02.2018 09:41, Kalyana sundaram
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CABWX_dq50oEhQVpJck44nFAwgK64w=bf_6OhM=S4-qkM=Q2T5A@mail.gmail.com">
<div dir="ltr">Hey All<br>
I am very new to dovecot ecosystem. Found the software really
robust and secure. Kudos to the team!!!<br>
We are setting up dovecot imap servers sharing a single nfs
mount point. So to avoid nfs cache issues, we are setting up
dovecot director. We are using dovecot version 2.2.10. While
going through the documentation of dovecot director I stumbled
across the following lines in passdb configuration <a
href="https://wiki2.dovecot.org/Director"
moz-do-not-send="true">https://wiki2.dovecot.org/Director</a><br>
<br>
"Note that while this is the simplest director configuration,
users will be assigned to a backend before they have been
authenticated. A director configured this way can be attacked
by sending it a large number of unknown users. To prevent this,
the director should be configured to authenticate the user and
might make use of a master password to log into the backend
servers."
<div><br>
</div>
<div><br>
</div>
<div>I understand on static passdb config dovecot assigns a user
to a machine in the list of backends by using
md5(username)%number_of_mail_servers. But other than this
calculation it does not incur any other resources. It does
have tcp connection with the system which is trying to do
bruteforce. If we move to authenticating users directly at the
director server, the director servers imap-login director
service should be anyways loaded on an attack. Is it anything
to do that the imap-login will contact auth process
asynchronously and keep itself free? I am pretty sure I am
overlooking some point on the above statement. Can somebody
throw some light on that?<br>
<div>
<div><br>
</div>
-- <br>
<div class="gmail_signature">Kalyanasundaram<br>
<a href="http://blogs.eskratch.com/" target="_blank"
moz-do-not-send="true">http://blogs.eskratch.com/</a>
<div><a href="https://github.com/kalyanceg/"
target="_blank" moz-do-not-send="true">https://github.com/kalyanceg/</a><br>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
</body>
</html>