sendmail load configuration

This post is about a neat trick that I have not seen many times discussed. According to the configuration README the default values for controlling load averages are:

  • confQUEUE_LA (QueueLA) Load average at which queue-only function kicks in. Default values is (8 * numproc) where numproc is the number of processors online (if that can be determined).
  • confREFUSE_LA (RefuseLA) Load average at which incoming SMTP connections are refused. Default values is (12 * numproc) where numproc is the number of processors online (if that can be determined).

However in “Sendmail Theory and Practice” (I am a proud owner of both editions) Paul Vixie and Fred Avolio propose a different approach:

“Astute readers will note that the value shown for Ox (QueueLA) is larger than the value shown for OX (RefuseLA), and that this is opposite from the configuration files you may have seen elsewhere. Setting them as shown here gives Sendmail a range of load average in which it is capable of delivering messages from its queue but incapable of receiving new messages. This is intentional. If you set Ox to be less than OX, Sendemail has instead a range of load average in which it can receive new mail (thus adding to the queue) but cannot deliver any queued mail. We believe that mail queues should become smaller or stay the same size when the load average is high. After watching our large mail gateway computers melt down many times over the years, we have learned that it is better to let other hosts’ mail stay where it was -on other hosts- when our load average is high, than to accept it even though we don’t plan to do anything with it until load average becomes low again.”

In other words although the defaults suggest otherwise, it may be wiser to have QueueLA > RefuseLA. This piece of advice is on both the 1995 (1st) and 2002 (2nd) editions of the book. A pearl that comes from 1995 that is still relevant.

AthCon begins

“A beginning is the time for taking the most delicate care that the balances are correct” –Frank Herbert’s Dune.

AthCon begins today. Since it is the first AthCon it really begins today. It is a non-product, non-vendor-biased conference aiming to present the best research and cutting edge exploitation techniques from the field’s leading experts. I feel extremely privileged that I was invited to participate in the (first) PC of such an effort. However due to the 24-hour strike of the public transportation workers and the law of unexpeted consequences that always finds opportunity to emerge I will not be able to attend the event. I was really looking forward to watch:

  • “OWASP Top 10 – 2010: Towards a secure Software Development Lifecycle” by Konstantinos Papapanagiotou
  • “Context-Keyed Payload Encoding: Fighting the Next Generation of IDS” by Dimitrios Glynos and
  • “BNF (Backus-Naur Form) based blackbox fuzzing” by Chariton Karamitas

Maybe these kind souls will email me their presentations.

Good luck AthCon and be a nice journey. See you next year and every year!