dovecot - Apr 2007 - testing LDAP connections

Hello all,

I haven't looked into the source code, but i suspect that LDAP
connections, once established, are not tested properly.

My scenario is the followind:


Dovecot server <--------> firewall <---------> LDAP backend


    What happens is that the firewall has a security feature which
basically make de firewall box "forget" about connections that are
idle
for more than X period of time. That particular setting is 30 minutes
right now. When that happens, neither the LDAP backend or the Dovecot
server get any type of notification, and for all they care the
connection is alive and well. This is a very common implementation in
firewalls nowadays.

    So my question is, is there any way to make dovecot re-open a new
connection if there is a timeout while trying to use a connection
already opened? I believe that this could be of great benefit for those
who don't have their servers on the same physical network.

Thanks in advance,

Hugo Monteiro.

 

-- 
ci.fct.unl.pt:~# cat .signature

Hugo Monteiro
Email	 : hugo.monteiro at fct.unl.pt
Telefone : +351 212948300 Ext.15307

Centro de Inform?tica
Faculdade de Ci?ncias e Tecnologia da
		   Universidade Nova de Lisboa
Quinta da Torre   2829-516 Caparica   Portugal
Telefone: +351 212948596   Fax: +351 212948548
www.ci.fct.unl.pt	      apoio at fct.unl.pt

ci.fct.unl.pt:~# _

On Mon, 2007-04-02 at 14:48 +0100, Hugo Monteiro wrote:
>     So my question is, is there any way to make dovecot re-open a new
> connection if there is a timeout while trying to use a connection
> already opened? I believe that this could be of great benefit for those
> who don't have their servers on the same physical network.
So, as discussed in IRC for now there's this patch:
http://dovecot.org/patches/ldap-timeout.diff

I'm not sure if for v1.1 I should add that with the timeout configurable
in dovecot-ldap.conf (and same for SQL), or do something else such as
sending some dummy request to the LDAP server. Or alternative to a
"check once a second timeout" would be to check it only when the next
request arrives, and then do the reconnection. That'll of course slow
down that authentication a bit.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20070402/583501b7/attachment.bin>