Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to tweak vsftpd to achieve maximum performance for my usage:

  • I have only one or two clients that connect to the server.
  • File size is between ~15MB and 1GB.
  • Typical transfer batch represent between 1 and 2GB of data.

For testing purposes, I'm using a tmpfs on both sides (thus eliminating any disks bottleneck) with a single 1GB file.

When SSL is disabled, performance is good, with a transfer rate at ~120MB/s (reaching the limits of gigabit networking).

With SSL enabled only for control traffic (and not data traffic), performance drops at about 112MB/s, which is still within the acceptable limits.

However, when SSL is enabled for data flows, the transfer speed drops dramatically:

  • 6.7MB/s using 3DES & SHA (ssl_ciphers=DES-CBC3-SHA in vsftpd.conf)
  • 16MB/s using DES & SHA (ssl_ciphers=DES-CBC-SHA)

I didn't tested other ciphers, but from what I can see from the CPU usage during the transfer, it seems that vsftpd is only using a single cpu/core per client. While this can fit for large ftp sites with hundreds of clients, I'd like to avoid this behavior and use more ressources on the server.

On a side note, if you have any ideas regarding other openssl ciphers...

share|improve this question
    
Try the RC4-MD5 cipher. Seems to be a good balance of performance & security. –  HTTP500 May 2 '12 at 14:28
    
@HTTP500: indeed, way much better. 75MB/s average, albeit still using only 1 core. –  petrus May 2 '12 at 17:21
add comment

1 Answer

I just read http://unhandledexpression.com/2013/01/25/5-easy-tips-to-accelerate-ssl/ which suggests to run openssl speed. Depending on the results, you might want to pick another algorithm. Sadly, I have no idea how to spread the load of one encryption task to several cores.

share|improve this answer
    
Indeed. I'm using RC4-MD5, but still looking for the solution. –  petrus Jan 29 '13 at 21:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.