Re: [Dovecot] login processes from attacks staying for hours

[Timo Sirainen]

On Jul 28, 2008, at 4:38 AM, Asheesh Laroia wrote:

On Thu, 24 Jul 2008, Kai Schaetzl wrote:

Other programs have their own built-in values/parameters for timeouts,

which makes sense as one program's typical timeout needs may be quite

*configurable* parameters that control timeouts like how long an

different from another one. So, each program should at least have a few authentication can take or when a data transfer timeout occurs. The IDLE timeout in dovecot seems to be 30 minutes. I would expect it to close any non-authenticated connection *at least* after this time - if not earlier.

In v1.1 IDLE never disconnects on timeout, because several clients rely on this.

Indeed, as I recall, the IMAP protocol in general sets a 30 minute timeout across the board.

Right.

So killing any connection with no data for that long seems like a very sane idea. Timo, what do you think?

Non-authenticated sessions have a shorter timeout, something like 2 or 3 minutes. Authenticated non-IDLEing sessions are disconnected after 30 minutes.

PGP.sig
Description: This is a digitally signed message part