OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: SMTP-SASL auth failure caching.

From: Victor Duchovni (Victor.DuchovniMorganStanley.com)
Date: Sun Dec 02 2007 - 19:13:09 CST


On Sun, Dec 02, 2007 at 04:44:07PM -0500, Wietse Venema wrote:

> If the proxymap service had a "put" operation, would that suffice?
> Adding "put" support involves less code than adding an entire daemon
> and client module to Postfix. This would require a new parameter
> proxy_write_maps that complements the existing proxy_read_maps
> feature.

Proxymap has a process limit > 1, and does not support in memory tables. I
don't think it fits the bill...

> > > Is "auth_cache" really a good name for a service that remembers
> > > password failures?
> >
> > Perhaps auth_failure_cache? I didn't want it to be too long, as all
> > the others have short names.
>
> With proxymap, we sidestep that problem. One only has to specify
> the map name; the proxy_write_maps parameter would automagically
> whitelist the map that is used for auth failures, so no additional
> configuration would be needed.

We would need a single-instance clone of proxymap, and perhaps also
in-memory support. Also setsid() to avoid getting clobbered mid-update.

--
        Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:majordomopostfix.org?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.