Re: ucspi-tls (attn: Scott Gifford)

Josh Trutwin <[email protected]> writes:

> On Wed, 11 May 2005 23:39:23 -0400
> Scott Gifford <[email protected]> wrote:
>
> <snip>
>
>>   * I recommend setting the environment variables SSL_UID, SSL_GID,
>>     and SSL_CHROOT, which provides added security by having the SSL
>>     portion of the server run with reduced privileges in a chroot
>>     environment.
>
> Ok - I assume the best way to do this would be to create a completely
> separate UID / GID just for this:
>
> groupadd smtpsd
> useradd -g smtpsd -d /home/smtpsd -s /bin/false -c "Qmail TLS chroot"
> smtpsd
> mkdir /home/smtpsd
> chown smtpsd.smtpsd /home/smtpsd
> chmod 700 /home/smtpsd

Something like that.  I usually use a "ssl" account that I use for all
of my ssl-wrapped services, and I don't create a home directory, but
what you've posted should work fine.

>
>>   * You probably don't need ucspi-proto-hack, since sslserver is
>>     derived from tcpserver.
>
> I swear when I was testing this with my pop3sd setup that everything
> choked if the ucspi-proto-hack wasn't in there, I'll test it without
> again to make sure.

I assumed that ucspi-proto-hack set up a tcpserver-style environment
based on stunnel's information and the socket, but it looks like maybe
that's not correct.  So maybe it is necessary.

Good luck!  Let me know how things turn out.

----Scott.