[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Digest-MD5 SASL binds (solved)
Hi
I'd just like to close this thread by reporting the actual cause and the
solution:
> However, the main reason for all the fuzz had been that I get deadlocks when
> trying Digest-MD5 SASL binds. The 2.2.23 slapd does not flood the logs with
The real issue had been that in fact both machines involved were bored test
machines, which have everything in memory and all what's happening is me
typing through a ssh terminal.
This does not yield significant entropy and /dev/random locks. The longer the
nonces or session keys the more probable the deadlocks, i.e. TLS and
DIGEST-MD5 is a killer!
Actually, /dev/random is an overkill for session keys, in particular
since /dev/urandom is a really good implementation (analysed it in 2.4.18),
unless you plan to set up a CA producing some 1000 RSA keys a day.
Recompiling SASL with --devrandom=/dev/urandom solves the problem, but the
following is easier for non CA systems:
rm -f /dev/random
ln -s /dev/urandom /dev/random
man urandom to revert, if you would
Thanks for all your support,
- lars.