Re: ucspi-tls (attn: Scott Gifford)

On Tue, 31 May 2005, Josh Trutwin wrote:

> First off, a general question: is it possible to use the same
> qmail-smtpd run file to enable SSL/TLS connections and straight up
> SMTP connections (which is nice for local connections and webmail)?
> Right now I have to setup a seperate runfile to bind to port 465.  In
> my previous mailfront/TLS implementation (using a patch posted on this
> mailing list by Charlie Brady a while back) there was a TLSCOMMAND
> variable that was consulted by mailfront which executed
> smtpfront-qmail in a stunnel session if the STARTTLS command was sent.

Port 465 (ssmtp) establishes SSL immediately after connection, and SSL 
wraps the complete SMTP transaction. It's possible to do this with 
unmodified mailfront (or qmail-smtpd for that matter), using stunnel or 
sslio or various other tools.

My patch (and some work of Scott's) allows TLS to be negotiated on a 
previously plaintext connection, on port 25, using STARTTLS (RFC 2487).

You'll need separate run files for the processes listening on ports 25 and 
465.

---
Charlie