Subject: slow authentication

From: Iv Ray <[email-masked]>
Date: Wed, 22 Apr 2009 09:47:41 +0200

Hello everyone,

I am running a mail server compiled from the latest versions of  
Postfix and Cyrus IMAP with Cyrus SASL authentication on FreeBSD 6.x.

Some months ago the web mail (Squirrelmail) became extremely slow to  
login and on previous/next page inside the mail folder - it takes  
about 25 seconds both to login and to change page.

E-mail clients like Mac Mail became slow in the beginning only.

I did some research and had some conversations on the Cyrus IMAP  
mailing list and the direction so far is that the slowness is in the  
authentication process (e-mail clients like Mac Mail experience  
slowness only in the beginning, because they seem to authenticate only  
then, while Squirrelmail authenticates on every request). I was  
advised to turn off all Cyrus SASL modules except PLAIN and I did so,  
however the 25 seconds delay persists.

Does this sound familiar to someone?

Any help would be appreciated.

Iv

---

From: Dan White <[email-masked]>
Date: Wed, 22 Apr 2009 09:40:38 -0500

> Any help would be appreciated.

Iv,

The Cyrus SASL mailing list might be more appropriate for this question:

http://cyrusimap.web.cmu.edu/lists.html#lists

Some areas to look at - If you're using SSL/TLS during authentication, 
verify whether you're using /dev/random or /dev/urandom (see the manpage 
for 'random'). Using /dev/random may slow down your initial connection 
if you don't have enough entropy.

I would look more at sasl_pwcheck_method than sasl_mech_list. If 
sasl_pwcheck_method is not specified, it will attempt all installed 
pwcheck_methods in order. Try specifying your preferred method 
explicitly, if it isn't already.

If using the saslauthd pwcheck_method, trouble shoot saslauthd first for 
delays (testsaslauthd).

If using an exotic auxprop store method (e.g. MySQL, LDAP), trouble 
shoot those separately. Turn off sasl_auto_transition, if enabled, for 
trouble shooting.

Set your sasl_log_level to 7. Monitor your syslog/auth.log.

- Dan

---

From: Iv Ray <[email-masked]>
Date: Wed, 22 Apr 2009 17:11:49 +0200

On 22.04.2009, at 16:40, Dan White wrote:
> Some areas to look at - If you're using SSL/TLS during  
> authentication, verify whether you're using /dev/random or /dev/ 
> urandom (see the manpage for 'random'). Using /dev/random may slow  
> down your initial connection if you don't have enough entropy.
>
> If using the saslauthd pwcheck_method, trouble shoot saslauthd first  
> for delays (testsaslauthd).
>
> shoot those separately. Turn off sasl_auto_transition, if enabled,  
> for trouble shooting.
>

Dan,

Thanks a lot! - I am starting to follow your notes.

And sorry again for confusing the list, I'll keep that in mind.

Thank you again,
Iv