Subject: disable reverse-dns lookup in 2002b

From: "Henry Blackman" <[email-masked]>
Date: Tue, 25 Mar 2003 17:15:49 -0000

Hello.

I'm sure this question may have been asked before, however I am searching
for a definitive answer to the question:

How do I switch off reverse dns lookup off in the imapd server version
2002b.  I'm calling for desperate measures here: our dns server is slow and
thus connections to the IMAP server are so slow because of this.  The wait
can be up to 2 minutes before I get any response from the server.

Please help.

Cheers,
Henry

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Tue, 25 Mar 2003 09:29:25 -0800 (Pacific Standard Time)

On Tue, 25 Mar 2003, Henry Blackman wrote:
> 2002b.

In imap-2002b/src/osdep/unix/tcp_unix.c, change the line reading:

static long allowreversedns = T;/* allow reverse DNS lookup */

to:
				/* emergency: disable reverse DNS */
static long allowreversedns = NIL;

WARNING: this is not something that you should decide to do lightly.  It
will break some forms of authentication, as well as reduce the usefullness
of the syslogs.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.

---

From: Rich Graves <[email-masked]>
Date: Wed, 16 Apr 2003 23:52:15 -0400 (EDT)

On Tue, 25 Mar 2003, Mark Crispin wrote:

> [..]to:

Yes, kerberos requires reverse lookup of the server hostname.

However, since imap-2000, I've been able to do this:

--- imap-2001a/src/osdep/unix/tcp_unix.c.brandeis       2002-12-17 23:27:00.000000000 -0500
+++ imap-2001a/src/osdep/unix/tcp_unix.c        2002-12-18 01:20:19.000000000 -0500
@@ -843,7 +843,7 @@
 char *tcp_name (struct sockaddr_in *sin,long flag)
 {
   char *s,tmp[MAILTMPLEN];
-  if (allowreversedns) {
+  if (!flag) {
     struct hostent *he;
     blocknotify_t bn = (blocknotify_t)mail_parameters(NIL,GET_BLOCKNOTIFY,NIL);     void *data;

Everywhere there's a reverse DNS lookup that Kerberos cares about, the
tcp_host verbose flag is set. But it's not set in the less important (to
me) logging bits, so even when your local ISP screws up an in-addr
delegation, your clients can still connect quickly.

Absolutely no guarantee this will remain true, of course.

Mark might consider an officially supported "allowCLIENTreversedns" or
"LOGFILEreversedns" flag that still allows kerberos to function.
-- 
Rich Graves <[email-masked]>
UNet Systems Administrator