Re: ucspi-tls (attn: Scott Gifford)

Josh Trutwin <[email protected]> writes:

> On Tue, 31 May 2005 23:56:34 -0400
> Scott Gifford <[email protected]> wrote:
>
>> You can get this effect with shell scripting in your run file.
>> Something like:
>> 
>>   if [ -n "$STARTTLS" ]; then tlsflags="-w"; else tlsflags=""; fi
>>   ...
>>   sslserver $tlsflags ...
>
> Not sure I'm following you here.  Is this in the qmail-smtpd run file?
>  Doesn't this only run one time at qmail startup?  Do you run all your
> connections through sslserver regardless of whether or not they are
> SSL/Non-SSL/TLS?  Would you mind sharing your run file?  

Ah, I didn't understand what you wanted.  If you use the "-w" flag to
the patched sslserver, it can listen on port 25, and activate TLS when
it receives a STARTTLS command.  I think that's what you're after,
right?

If you don't use the "-w" flag, then it requires SSL from the
beginning, and should probably be run on port 465.

Does that make sense?  I think you were confused about this, and
that's why things didn't behave as you expected, and perhaps why your
tests failed.

Please let me know if there are still problems.

>> > Secondly, I get a problem using the chroot feature:
>> 
>> [...]
>> 
>> > export SSL_CHROOT=1
>> 
>> Set SSL_CHROOT to the directory to chroot to.
>
> Ok, that seemed to work - you might want to update the Docs on this to
> indicate the value of the env. var is a directory.  

Thanks, I'll do that.

----ScottG.