[19077] in Kerberos_V5_Development
Re: Fwd: [Bug 1179820] New: Kerberos KDC connection limit too low
daemon@ATHENA.MIT.EDU (Greg Hudson)
Sun Jan 18 12:39:45 2015
Message-ID: <54BBEFC3.9090101@mit.edu>
Date: Sun, 18 Jan 2015 12:39:15 -0500
From: Greg Hudson <ghudson@mit.edu>
MIME-Version: 1.0
To: Roland Mainz <rmainz@redhat.com>, krbdev@mit.edu
In-Reply-To: <1502374186.11149428.1421445461139.JavaMail.zimbra@redhat.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 01/16/2015 04:57 PM, Roland Mainz wrote:
> Does anyone know which limit the reporter in the bug report below may be referring to ?
Most likely the 45-connection limit in net-server.c.
> If the "45 connections limit" is the issue... would a patch be acceptable which adds code to query the resource limit for file descriptors ($ ulimit -n #) and then do a |max_tcp_or_rpc_data_connections=MAX(result/2, 45)| ?
I don't think the limit is there primarily to prevent fd exhaustion; it
also serves to limit user-space and kernel memory usage. A limit of 45
seems pretty low for any modern host, though.
I believe we would take a patch to make the limit configurable, and to
make the default somewhat higher than it is today. Configurable tuning
parameters aren't great, but I don't see any way to automatically choose
a limit in a way which approximates the highest load capacity while
preventing DOS attacks which disable the KDC through memory exhaustion.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
