[Proftpd-user] Strange (?) mod_ldap group lookup behaviour

Morning All,
                We’ve had a few users complaining recently about timeouts trying to connect to our ftp server
(Packaged version of proftd v 1.3.5 running on Debian 9 )

It looks like the cause is LDAP lookups but I’m not sure why this is only recently coming to light as we’ve not updated either proftpd or openLDAP recently.

What we’re seeing is proftpd doing an LDAP lookup for the user and their groups, then a lookup for each of the groups the user is in returning all of the members, then a lookup for every member in each group for the groups each members are in.

For users in some of our larger groups, that’s over 24,000 LDAP searches for one user logging in and it’s taking almost 25 seconds thus the timeouts.  It could be that the LDAP servers are slower than usual and this was previously significantly faster and we can investigate speeding things up but the 24K search operations seems a bit excessive.

We can look at hand rolling proftpd but prefer to stick to the packages and get automated patching or upgrade to Debian 10 for 1.3.6 if this is a known issue (I couldn’t find anything in the archives)  Otherwise has anyone come across this behaviour in the past and is there a way to configure mod_ldap to stop once it’s enumerated the users’ groups without then enumerating the groups of every member or every group the logging in user belongs to?

Thanks in advance.

   Duncan

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html