Add more Courier-IMAP connections under Plesk

By default, UNIX-based servers running Plesk and the Courier-IMAP e-mail server drastically limit the number of inbound connections to prevent users from opening up too many concurrent sessions. Unfortunately, this artificially-low restriction can impact legitimate users who have multiple computers connecting to the Courier-IMAP server from behind a firewall or a single computer that runs an IMAP client that takes advantage of mailbox caching.

Plesk comes configured with a limit of 4 connections per IP address and a limit of 40 connections total. Modern IMAP clients such as Mozilla Thunderbird use mailbox caching to open up multiple connections to increase performance. In the case of Thunderbird, it opens up 5 connections by default which is already 1 connection more than Courier-IMAP’s default restriction. Add another few family or corporate computers behind a firewall and those additional users won’t be able to connect at all since a single Thunderbird client is already utilizing all 4 connections.

To increase this restriction, modify the /etc/courier-imap/imapd configuration file and change MAXDAEMONS and MAXPERIP to a more sane number. In the case of my configuration, I changed MAXDAEMONS from 40 to 80 and MAXPERIP from 4 to 40. This allows all the machines behind my home firewall to connect to multiple accounts on the e-mail server with mailbox caching enabled.

But even those numbers may be too low for a corporate colocated server that services an entire company. Tweak those numbers based on your employee base; if 50 employees are connecting to the e-mail server from behind the same firewall then MAXPERIP could need to go as high as 250 (50 employees times 5 cached mailbox connections). Add e-mail clients of people working from home and MAXDAEMONS could go as high as 300 or 400.

Obviously, the connection limits are to prevent the Courier-IMAP server from using too many memory and CPU resources on the machine. Tweak the numbers based on the memory footprint of each daemon process and how much memory you have.

Careful with that FedEx account number

Taken from RISKS Digest 24.43:

Date: Wed, 20 Sep 2006 10:45:49 -0700
From: Matt Wilbur <[email protected]>
Subject: Careful with that Fedex account number

Sending packages with Fedex is now easier than ever, thanks to the fedex.com website. Unfortunately, it’s too easy. In most cases, if you know a company’s account number, you can send whatever you like using the site, assuming you have a pulse, a browser, and access to the Internet.

We recently had an angry ex-employee use our account number to send multiple small dollar amount packages all over the place. The dollar value was too low for the authorities, and it was really just a nuisance. Our “Fedex
person” called Fedex to stop this, and customer service told her the only way was to change our account number. This would be painful, so we sent him letters telling him to stop. It didn’t. We called Fedex again, this time asking for security, using words/phrases like “fraud,” “theft,” and “you will have to pay when we reverse the charges.” We didn’t get anyone from Security, but they did begin to listen.

After being bounced around at fedex, we learned the following:

  • Unless you take specific action (enable and configure Shipping Administration for your account within Ship Manager on the website), anyone on the planet can create a fedex.com account, associate it with your account number, and ship whatever, wherever they way, third party included.

  • there is no way, even with shipping administrator, within fedex.com, to view the logins associated with your account. We had to call and insist on a list – for “security” reasons they could not email or otherwise send us a list, but were able to tell us logins, names, last login, and email of active accounts.

After setting up Shipping Administration, we verified that this ex-employee (or anyone else we don’t approve) can no longer set up a new login and associate it with our account.

After about an hour on the phone, we were able to get his login deleted (and learn all of this additional information about their system).

Risks? For Fedex? Not defaulting to a more secure configuration (like, want to use fedex on the web? First sign-in associated with that fedex account must set up “Shipping Administrator” to prevent unauthorized use). Building an application with all the shipping capabilities imaginable available, and very little for the account holder to manage access and security. Not having a security contact or phone number listed, or accessible by calling in to customer service. Money lost to fraud by abuse of this system.

For the Fedex user? Giving your fedex account number to third parties who may ship things to you, unless you know and trust them, and trust their handling of your account number. Not watching your bills closely. Signing up and using for a service that, when you think about it, is far too easy to use to have any built-in safety.