Subject: Perdition IMAP Proxy

From: Yanik Charbonneau <[email-masked]>
Date: Thu, 08 Jul 2004 12:58:49 -0400

Hi All,

Sorry if this is the wrong list, I tried posting this in the IMAP list
but go no replis.

Hi All,

So we made a BIG mistake last year implementing a new mail
infrastructure using NFS as a mail store for our mail.

This year we would like to replace this solution with a Perdition
implementation using NIS.  Anybody have comments on perdition?

Here is some info about our situation;

60000 users
1 x P4 2Ghz for the perdition box
6 x Dual Xeon 2.4Ghz 1GB RAM (for ?nodes?)

cheers

Yanik

-- 
Yanik Charbonneau                                 /~\  The ASCII
University of Ottawa                              \ /  Ribbon Campaign
Ottawa, Ontario                                    X   Against HTML
Canada                                            / \  Email! 

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: scott hollatz <[email-masked]>
Date: Thu, 8 Jul 2004 12:34:50 -0500 (CDT)

[stuff deleted]
> 6 x Dual Xeon 2.4Ghz 1GB RAM (for ?nodes?)

We completely redid our email architecture seven months ago after years
of (poorly) relying on NFS, and perdition is a critical component.

Overall, it very works well.  I have not tested STARTTLS or SSL through
it yet (planned) but works great with the UW IMAP and POP servers.

You might want to forget NIS.  We had some difficulty with OpenLDAP for
the database in production (mainly due to a flakey build) so yanked it
in favor of a DBM lookup.  Going back to LDAP is planned, though.  We have
about 27K users.

Perdition as a standalone server doesn't do address checks like the
tcp_wrappers library, and if your IMAP or POP is started via (x)inetd
and does the checks, it won't help.  The best solution is to modify
perdition to use libwrap _or_ start via (x)inetd.

We run perdition on two dual 1.4GHz Pentiums running FreeBSD 4.9-STABLE.
All of our IMAP and POP traffic goes through them, whether from desktops
or webmail systems (which also runs an IMAP proxy, so the proxy to the
proxy works great, too).

-- 
scott hollatz                                        net [email-masked]
information technology systems and services          tel +1 218 726 8851
university of minnesota duluth mn usa                fax +1 218 726 7674
                                                                         --
                                            "gabba gabba hey" - the ramones

---

From: Mark Crispin <[email-masked]>
Date: Thu, 8 Jul 2004 10:37:07 -0700 (PDT)

I don't know enough about Perdition to comment intelligently on that 
product.  However, I'll comment about proxies in general.

Proxies are complex and extremely sensitive.  They are difficult to get 
right even by a highly skilled and experience programmer.  Unfortunately, 
proxies also appear to be simple to implement even by a novice programmer; 
and that fact tends to exacerbate the other problems.

When you talk with experienced programmers, you can always tell who have 
worked on proxy software; they're the ones who make an involuntary shudder 
every time the word "proxy" is uttered.

There are certainly uses and needs that are best filled by proxies, but 
this is not a choice to be made lightly.

What are you attempting to accomplish by the use of a proxy?  It's obvious 
that you want to get rid of NFS as a mail store, and that is certainly a 
wise move.  But I am unclear about what sort of architecture, using an 
IMAP proxy, you purpose to deploy as a replacement.

In my opinion, the primary use for an IMAP proxy is as part of a firewall. 
That is, the proxy would handle authentication and rejection of bad 
syntax, so that the back end only ever sees authenticated sessions and 
good syntax, providing a modest defense against certain denial-of-service 
attacks.  I'm not convinced that the benefit is worth the expense.  A 
determined attacker can overwhelm this defense, and the resources 
available to attackers are greater than what the defenders possess.

If an IMAP proxy accomplishes something else, I would be very interested 
in hearing what that is.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: Brad Arlt <[email-masked]>
Date: Thu, 8 Jul 2004 11:56:05 -0600

> Proxies are complex and extremely sensitive.  They are difficult to get 
[snip]
> If an IMAP proxy accomplishes something else, I would be very interested 

Perdition is meant to allow you to have "one" imap server, as far as
your users are concerned, and as many real IMAP servers as needed.

Perdition chooses the correct server for each user, and proxies the
connection to it for the user.  This can also be handled using
LOGIN-REFERRALS but sadly not all mail clients support this.

The link for you, or for those looking in the archive wondering
where they can find this thing :)

http://www.vergenet.net/linux/perdition/
-----------------------------------------------------------------------
   __o		Bradley Arlt			Security Team Lead
 _ \<_		[email-masked]		University Of Calgary
(_)/(_) 	Las hojas de coca no son droga 	Computer Science

---

From: Mark Crispin <[email-masked]>
Date: Thu, 8 Jul 2004 11:16:19 -0700 (PDT)

> LOGIN-REFERRALS but sadly not all mail clients support this.

That seems to be a lot of ongoing (and permanent) work and resources just 
to avoid a simple one-time user configuration.

You can simply have a special DNS zone in which each user is registered 
and points to the correct IMAP server, and dispense with proxies.

mrc.deskmail.washington.edu always points to mrc's IMAP server, even 
though the machine changes over time.

The experience at UW has shown that this is not particularly difficult to 
explain even to novice users.

-- Mark --

---

From: Thomas Lohman <[email-masked]>
Date: Thu, 08 Jul 2004 14:15:35 -0400

> implementation using NIS.  Anybody have comments on perdition?

Yanik,

I'm currently ready to roll out a new setup that incorporates perdition. 
  I've been testing it using only secure POP/IMAP connections and it has 
been working fine.  I have a much smaller user community so my reasons 
for using it is a temporary migration - I'm splitting mail services 
across multiple machines and am changing the name of the POP/IMAP server 
and thus don't want to force everyone to change their settings 
overnight.  Eventually I'll switch it off.  We currently don't have a 
big enough load to split our users across mutliple underlying pobox 
machines.  So, I can't comment on it's use as a permanent gateway/load 
balance setup which I assume is what you want to do.  From what I read 
in my research looking at POP/IMAP proxies, it seemed to get good 
feedback from real users.

cheers,

--tom

---

From: Brad Arlt <[email-masked]>
Date: Thu, 8 Jul 2004 14:16:53 -0600

> though the machine changes over time.

Holy crap, that is a beautiful solution!  Shifting all the fiddly bits
to a PHP/perl script....  And no prolonged struggle with proxy
software not supporting all the features it should!

One thing I will stress to the folks still hooked on proxy software to
solve this problem:

Things that do not need to use the proxy (webmail for example) should
contact your IMAP servers directly.  This allows your users access to
their email without the added point of failure.  Plus it takes some
load off the proxy.
-----------------------------------------------------------------------
   __o		Bradley Arlt			Security Team Lead
 _ \<_		[email-masked]		University Of Calgary
(_)/(_) 	Las hojas de coca no son droga 	Computer Science