Re: ucspi-tls (attn: Scott Gifford)

On Wed, 11 May 2005 23:39:23 -0400
Scott Gifford <[email protected]> wrote:

<snip>

>   * I recommend setting the environment variables SSL_UID, SSL_GID,
>     and SSL_CHROOT, which provides added security by having the SSL
>     portion of the server run with reduced privileges in a chroot
>     environment.

Ok - I assume the best way to do this would be to create a completely
separate UID / GID just for this:

groupadd smtpsd
useradd -g smtpsd -d /home/smtpsd -s /bin/false -c "Qmail TLS chroot"
smtpsd
mkdir /home/smtpsd
chown smtpsd.smtpsd /home/smtpsd
chmod 700 /home/smtpsd

>   * You probably don't need ucspi-proto-hack, since sslserver is
>     derived from tcpserver.

I swear when I was testing this with my pop3sd setup that everything
choked if the ucspi-proto-hack wasn't in there, I'll test it without
again to make sure.

> You can use stunnel's client features to test your configuration,
> and follow the documentation for relay-ctrl and rblsmtpd to make
> sure those are configured correctly.

Thanks,

Josh