Re: ucspi-tls (attn: Scott Gifford)

On Tue, 31 May 2005 23:56:34 -0400
Scott Gifford <[email protected]> wrote:

> You can get this effect with shell scripting in your run file.
> Something like:
> 
>   if [ -n "$STARTTLS" ]; then tlsflags="-w"; else tlsflags=""; fi
>   ...
>   sslserver $tlsflags ...

Not sure I'm following you here.  Is this in the qmail-smtpd run file?
 Doesn't this only run one time at qmail startup?  Do you run all your
connections through sslserver regardless of whether or not they are
SSL/Non-SSL/TLS?  Would you mind sharing your run file?  

> > Secondly, I get a problem using the chroot feature:
> 
> [...]
> 
> > export SSL_CHROOT=1
> 
> Set SSL_CHROOT to the directory to chroot to.

Ok, that seemed to work - you might want to update the Docs on this to
indicate the value of the env. var is a directory.  

" Adds privilege seperation to SSL.  All SSL operations can now be
  done inside a chroot jail, with a dedicated UID and GID.  To enable
  this, set the SSL_CHROOT environment variable, the SSL_UID
  environment variable, and/orthe SSL_GID environment variable."

I guess the UID and GID vars were obvious enough, I thought SSL_CHROOT
might be a boolean...

> Check permissions on certificates, and make sure they're readable by
> the user and group you're running sslserver as.  I find the easiest
> way to debug these sorts of bugs is using strace/truss/ktrace.
> Another useful tool is using stunnel to connect, and turning its
> debuggin flags all the way up.
> 
> One more thing to try: see if regular SSL (not STARTTLS) works with
> vanilla ucspi-ssl.
> 
> Good luck, and let me know how it goes,

Ok, with straight SSL I get the following:

@40000000429dbc4214385694 sslserver: cafile 26680 
@40000000429dbc42144f842c sslserver: ccafile 26680 
@40000000429dbc421450eb8c sslserver: cadir 26680 /etc/ssl/CA
@40000000429dbc421451ba94 sslserver: cert 26680
/etc/ssl/certs/smtps.cert
@40000000429dbc42145285b4 sslserver: key 26680
/etc/ssl/private/smtps.key
@40000000429dbc42145354bc sslserver: param 26680 /etc/ssl/dhparam.pem
512
@40000000429dbc421454ac7c sslserver: status: 0/31

(the above is from starting up my qmail-smtpsd run file which listens
on 465 - below is an attempt to send a message)

@40000000429dbc5435a698a4 sslserver: status: 1/31
@40000000429dbc5435b2a2ac sslserver: pid 26682 from 64.83.223.150
@40000000429dbc5435b74a14 sslserver: ok 26682 0:192.168.0.3:465
:64.83.223.150::18879
@40000000429dbc550290363c sslserver: ssl 26681 accept 
@40000000429dbc55310dde74 smtpfront-qmail[26682]: SASL AUTH LOGIN
username=josh
@40000000429dbc55361417e4 smtpfront-qmail[26682]: MAIL
FROM:<[email protected]> SIZE=356
@40000000429dbc553b1c87bc smtpfront-qmail[26682]: RCPT
TO:<[email protected]>
@40000000429dbc5708532ffc smtpfront-qmail[26682]: Accepted message qp
26685 bytes 464
@40000000429dbc571e8299ac smtpfront-qmail[26682]: bytes in: 514 bytes
out: 315
@40000000429dbc5723eb4254 sslserver: warning: dropping connection,
unable to speak SSL: error:00000005:lib(0):func(0):DH lib
@40000000429dbc5723f592f4 sslserver: end 26681 status 28416
@40000000429dbc5723f5ae4c sslserver: status: 0/31

The warning looks bad, but it does deliver the message.

Here's an attempt with STARTTLS:

@40000000429dbd7d06abcd44 sslserver: status: 1/31
@40000000429dbd7d06d588dc sslserver: pid 26762 from 64.83.223.150
@40000000429dbd7d06da3fe4 sslserver: ok 26762 0:192.168.0.3:465
:64.83.223.150::24312
@40000000429dbd9709af2a04 sslserver: warning: dropping connection,
unable to accept SSL: error:00000002:lib(0):func(0):system lib
@40000000429dbd9709c48aac smtpfront-qmail[26762]: bytes in: 0 bytes
out: 23
@40000000429dbd9709c4a604 sslserver: end 26761 status 28416
@40000000429dbd9709c4b98c sslserver: status: 0/31

The client essentially hangs while attempting to send.  

I don't know how helpful it is but I took an strace with:

strace -o strace.out /service/qmail-smtpsd/run 

you can find it here: http://trutwins.homeip.net/strace.out - I trace
one STARTTLS attempt followed by one SSL attempt.

Here's my qmail-smtpsd run file - I'd still prefer to have this
somehow merged into my qmail-smtpd run file to accept all connections,
SSL or not, on port 25, but this will do for testing purposes:

# more /service/qmail-smtpsd/run 
#!/bin/sh

# Script created from reading Life with qmail documentation

CONLIMIT=31

# enable UCSPI-TLS
export UCSPITLS=1
# enable this to force TLS
# export AUTH_REQUIRES_TLS=1
# run in chroot
export SSL_CHROOT=/home/smtpsd
export SSL_UID=6039
export SSL_GID=1011
export CERTFILE=/etc/ssl/certs/smtps.cert
export KEYFILE=/etc/ssl/private/smtps.key

# relay-ctrl expects tcpserver, to get around this,
# set env var and use perl script uspci-proto-hack
# http://multivac.cwru.edu./#quickies
# see /etc/relay-ctrl/NEWPROTO

exec /usr/local/bin/envdir /etc/mailfront/smtpfront \
    /usr/local/bin/softlimit -m 40000000 \
    /usr/local/bin/envdir /etc/relay-ctrl \
    /usr/local/bin/relay-ctrl-chdir \
    /usr/local/bin/sslserver -v -R -H -l 0  \
      -c ${CONLIMIT} \
      -x /etc/tcp.smtp.cdb \
      0 465 \
    /usr/local/bin/uspci-proto-hack \
    /usr/local/bin/relay-ctrl-check \
    /var/qmail/bin/mailrules.sh \
    /usr/local/bin/rblsmtpd -t45 -b -rlist.dsbl.org -rrelays.ordb.org
\
    /usr/local/bin/smtpfront-qmail 2>&1

Thanks for your help,

Josh