Re: ucspi-tls (attn: Scott Gifford)

On Wed, 1 Jun 2005 10:49:01 -0400 (EDT)
Charlie Brady <[email protected]> wrote:

> Port 465 (ssmtp) establishes SSL immediately after connection, and
> SSL  wraps the complete SMTP transaction. It's possible to do this
> with  unmodified mailfront (or qmail-smtpd for that matter), using
> stunnel or  sslio or various other tools.
> 
> My patch (and some work of Scott's) allows TLS to be negotiated on a
> 
> previously plaintext connection, on port 25, using STARTTLS (RFC
> 2487).
> 
> You'll need separate run files for the processes listening on ports
> 25 and  465.

I kind of liked your patch for this reason, only one external port
(thus only one instance of qmail/mailfront) was needed for both plain
SMTP and STARTTLS/SSL connections.  My current email client is not
smart enough to connect to port 465 by default when you tell it to use
SSL or STARTTLS unless you also specify the port.  Not a big deal to
me, but for some naive users this is not an obvious additional step.

The benefits of the UCSPI-TLS patch seem to be having this run in a
chroot and that the entire conversation is wrapped in SSL.  With your
patch is this latter such a drawback?  It seems like only the EHLO and
STARTTLS would be plaintext right?  I guess another benefit is an
unpatched mailfront...

Josh