On 15.2.2011, at 16.19, Thomas Hummel wrote:
> login_max_processes_count = 1024
>
> auth default {
> [...]
> count = 5
> }
>
> I've got several questions :
>
> 1) how can I count more than login_max_processes_count processes ?
>
> # ps aux | egrep -i '(pop3|imap)-login' | wc -l
> # 1031
It's max. 1024 for imap-login and max. 1024 for pop3-login.
> 2) could be my auth process count the bottleneck ?
> is there a rule of thumb to deduce it from the login process count ?
Well, with v2.0 you couldn't even have more than 1 auth process. LDAP is used
asynchronously, so it should work ok. Although are you using auth binds? That's
less efficient.
I think anyway the problem has to do with login processes. In v1.x new
processes are forked in a bit dummy way, which I just copied from Apache but I
don't think it really helps with anything.. Anyway, it can only double the
process count once every second. So if there's a large burst of connections,
some of them start hanging. I think you should just try if
login_process_per_connection=no solves everything. Yeah, it's less secure than
"yes", but in practice that's pretty much what all large installations use
anyway. There are no known Dovecot or OpenSSL security holes now, so it should
be safe. :)
> 3) on dovecot login/master/auth design, is my understanding correct ?
>
> - dovecot-1.2.x :
>
> . passdb and userdb lookup are done by the auth process, on behalf of either
> the
> login process which wants to know if the client's password is correct or
> of the
> master process which wants to check if it was actually correct and which
> wants
> to have the userdb info.
>
> . client connection fd is sent to the master which creates the mail process
> and
> transfers the fd to it.
Yes.
> - dovecot-2.x :
>
> . client connection fd does not go through the master anymore but through a
> socket in the login/ directory
>
> . it's the mail process which ask the auth process for the userdb lookup
Yep. The code and idea is similar, but now it's running in the mail process
rather than master process. This change also removed the possibility of having
more than one auth process (if it becomes necessary, I guess they could be
added back by having each auth process listen on a differently named unix
socket, like auth-master-<pid>).
> 4) with LDAP backend using {CRYPT} passwords dans with plaintext auth enabled
> in dovecot,
> is the clear password crypted before comparing it to the LDAP crypted
> password
Yes, if auth_bind=no.
> or does dovecot try to simply bind to LDAP with the clear password ?
Yes, if auth_bind=yes.
