1

I have setup courier with imapd-ssl on ubuntu. Everything works fine: ssl certificates validate (on ubuntu/thunderbird and mac/mail) and login works, too.

The only problem is that it ALWAYS takes about half a minute for the handshake. If I do

openssl s_client -showcerts -connect myserver:993

I get "CONNECTED(00000003)" and then it hangs for half a minute

The time between the command and until I receive in mail.log:

myserver imapd-ssl: Connection, ip=[::ffff:89.136.227.107]

on the server logs is always between 29 and 32 seconds. Any idea what could cause that? Postifx, HTTPS seem to respond lightning fast.

UPDATE: I have tried to connect from an hotel and it seems to work fine. So my guess is that it's an issue of firewalls on either my home router or the server's firwall (ufw/iptables). I have read somewhere that when either of the systems has a firewall up, the courier seemed to take ages to login/authenticate. Some guy (http://de.comm.software.mailserver.narkive.com/GIvIajz6/courier-imap-sehr-langsam-mit-iptables) suggested that it happenens to courier when iptables are set. However, disabling them in my case didn't do the trick..

  • Check your DNS, they are maybe filtered or down to solve the client IP address – Dom Mar 22 '13 at 10:00
  • If it was a DNS problem it would be consistent across all services, or am i mistaken? If I connect to postfix via ssl (openssl s_client -showcerts -connect myserver:465) it connects in an instance. – Roman Semko Mar 22 '13 at 10:36
2

Courier imapd tries to do reverse DNS and ident lookups by default. Make sure you disable these, as one or the other (or both) is the most likely cause (and doing reverse DNS lookups at connection time leads to bad security).

For instance:

/usr/lib/courier-imap/libexec/couriertcpd ... -nodnslookup -noidentlookup ...

Check your system's startup scripts to find out how it wants to add these options to the command.

  • Thanks! adding TCPDOPTS="-nodnslookup -noidentlookup" to courier imap settings solved the problem. More info: forums.hostforweb.com/… =) Hoorray! – Roman Semko Mar 25 '13 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.