ucspi-tls for mailfront-0.96

[Scott Gifford]

I've finally found some time to forward-port UCSPI-TLS to
mailfront-0.96. The changes are quite minimal. You can find the
latest version here:

http://www.suspectclass.com/~sgifford/ucspi-tls/mailfront-0.96-ucspitls-0.1.patch
http://www.suspectclass.com/~sgifford/ucspi-tls/mailfront-0.96-ucspitls-0.1.readme

The patch enhances mailfront's SMTP, POP, and IMAP with support for
UCSPI-TLS:

http://www.suspectclass.com/~sgifford/ucspi-tls/ucspi-tls.txt

The changes cause the frontends to recognize a request to begin TLS
encryption and pass the request along to a parent server. The actual
SSL implementation is in a tcpserver-style server, and can run all
client-directed encryption operations in a chroot jail with reduced
privileges, for much increased security. This is currently
implemented as a patch:

http://www.suspectclass.com/~sgifford/ucspi-tls/

to ucspi-ssl:

http://www.superscript.com/ucspi-ssl/intro.html

I've run a previous version of this software for about 8 months on the
machine of a consulting client, and it's worked quite well. Please
send along any questions, comments, or bug reports to me, or the
appropriate mailing list.

Thanks,

---ScottG.

[Josh Trutwin]

On Mon, 29 Aug 2005 01:34:42 -0400

Post by Scott Gifford
I've finally found some time to forward-port UCSPI-TLS to
mailfront-0.96. The changes are quite minimal.

Thanks Scott! I'll try it today and report any issues...

Josh

[Josh Trutwin]

On Mon, 29 Aug 2005 08:49:37 -0500

Post by Josh Trutwin
On Mon, 29 Aug 2005 01:34:42 -0400

Post by Scott Gifford
I've finally found some time to forward-port UCSPI-TLS to
mailfront-0.96. The changes are quite minimal.

Thanks Scott! I'll try it today and report any issues...

Scott,

Works great, upgraded both a Debian Sid and a Slackware 10.0 server,
no problems - thanks for the hard work on this (and to Bruce,
UCSPI-SSL folks, etc). I was able to upgrade my bglibs, cvm, mailfront
and ucspi-ssl all to the latest versions. The ucspi-ssl updates
remove that odd SSL warning in the logs on every connection.

My toaster is just humming along - thanks again. Now if only I could
convince people to actually USE SSL/TLS...

Josh

[Charlie Brady]

Post by Josh Trutwin
My toaster is just humming along - thanks again. Now if only I could
convince people to actually USE SSL/TLS...

Denying relaying unless they do might inconvenience them enough to
encourage them to change. Of course, you'd notice the support load in the
meantime.

---
Charlie

[Scott Gifford]

Post by Charlie Brady

Post by Josh Trutwin
My toaster is just humming along - thanks again. Now if only I could
convince people to actually USE SSL/TLS...

Denying relaying unless they do might inconvenience them enough to
encourage them to change. Of course, you'd notice the support load in
the meantime.

Yeah, the mailfront patches support requiring TLS to authenticate, so
you could require authentication for relaying, then require TLS for
authentication.

There's not an easy way to require TLS for relaying directly, but if
it would be useful I could probably find a good hook to hang support
for it on.

----Scott.

[Josh Trutwin]

On Tue, 30 Aug 2005 11:25:51 -0400

Post by Scott Gifford

Post by Charlie Brady

Post by Josh Trutwin
My toaster is just humming along - thanks again. Now if only I could
convince people to actually USE SSL/TLS...

Denying relaying unless they do might inconvenience them enough to
encourage them to change. Of course, you'd notice the support load in
the meantime.

Yeah, the mailfront patches support requiring TLS to authenticate, so
you could require authentication for relaying, then require TLS for
authentication.
There's not an easy way to require TLS for relaying directly, but if
it would be useful I could probably find a good hook to hang support
for it on.

That's ok - it's more an education issue. Explaining the benefits,
etc. My client base is shared with someone else which makes these
kinds of issues difficult to manage.

Thanks,

Josh