Re: ucspi-tls (attn: Scott Gifford)

Josh Trutwin <[email protected]> writes:

> I'm trying to test Scott Gifford's UCSPI-TLS patches but I'm a little
> confused on how to switch my current mailfront TLS implementation.

[...]

> The UCSPI-TLS method doesn't seem to use the TLSCOMMAND environment
> var. like the old patch did.  So if I wanted to use UCSPI-TLS instead
> of stunnel, would I create a qmail-smtpsd/run file like this? (sort of
> a mix of my qmail-smtpd run script and my ucspi-ssl qmail-pop3sd run
> script):

It looks about right, though I'm not sure exactly how all the
different features your using should be configured.  A few things:

  * I recommend setting the environment variables SSL_UID, SSL_GID,
    and SSL_CHROOT, which provides added security by having the SSL
    portion of the server run with reduced privileges in a chroot
    environment.

  * You probably don't need ucspi-proto-hack, since sslserver is
    derived from tcpserver.

You can use stunnel's client features to test your configuration, and
follow the documentation for relay-ctrl and rblsmtpd to make sure
those are configured correctly.

----ScottG.