Re: ucspi-tls (attn: Scott Gifford)

On Thu, 02 Jun 2005 02:23:41 -0400
Scott Gifford <[email protected]> wrote:

> Ah, I didn't understand what you wanted.  If you use the "-w" flag
> to the patched sslserver, it can listen on port 25, and activate TLS
> when it receives a STARTTLS command.  I think that's what you're
> after, right?
> 
> If you don't use the "-w" flag, then it requires SSL from the
> beginning, and should probably be run on port 465.
> 
> Does that make sense?  I think you were confused about this, and
> that's why things didn't behave as you expected, and perhaps why
> your tests failed.
> 
> Please let me know if there are still problems.

I'm always confused.  :)

So my run file for qmail-smtpd should not use tcpserver, but use
sslserver for all connections and with -w.  I did this and it seems to
work:

# more /service/qmail-smtpd/run
#!/bin/sh

# Script created from reading Life with qmail documentation

CONLIMIT=31

# enable UCSPI-TLS
export UCSPITLS=1
# enable this to force TLS
# export AUTH_REQUIRES_TLS=1
# run in chroot
export SSL_CHROOT=/home/smtpsd
export SSL_UID=6039
export SSL_GID=1011
export CERTFILE=/etc/ssl/certs/smtps.cert
export KEYFILE=/etc/ssl/private/smtps.key

exec /usr/local/bin/envdir /etc/mailfront/smtpfront \
    /usr/local/bin/softlimit -m 40000000 \
    /usr/local/bin/envdir /etc/relay-ctrl \
    /usr/local/bin/relay-ctrl-chdir \
    /usr/local/bin/sslserver -e -w -v -R -H -l 0  \
      -c ${CONLIMIT} \
      -x /etc/tcp.smtp.cdb \
      0 25 \
    /usr/local/bin/relay-ctrl-check \
    /var/qmail/bin/mailrules.sh \
    /usr/local/bin/rblsmtpd -t45 -b -rlist.dsbl.org -rrelays.ordb.org
\
    /usr/local/bin/smtpfront-qmail 2>&1

This works for STARTTLS and vanilla SMTP.  For STARTTLS though I still
get the following warning:

@40000000429f3189285946ec sslserver: warning: dropping connection,
unable to speak SSL: error:00000005:lib(0):func(0):DH lib

Is this anything to be concerned with?

If I configure my client to use SSL then it attempts to go to port 465
so I guess I'll still run a qmail-smtpsd that doesn't use -w and binds
to port 465.  This also seemed to work (again with the same warning).

Also, from reading the sslserver docs on
http://www.superscript.com/ucspi-ssl/environment.html I noticed the -e
flag which means I can get rid of uspci-proto-hack.  :)

FYI, the patch doesn't apply cleanly to mailfront-0.94:

> patch -p1 < ../patches/mailfront-0.92-ucspitls-0.1.patch 
patching file Makefile
Hunk #1 FAILED at 44.
Hunk #2 FAILED at 105.
Hunk #3 FAILED at 176.
Hunk #4 FAILED at 194.
4 out of 4 hunks FAILED -- saving rejects to file Makefile.rej
patching file TARGETS
Hunk #1 succeeded at 61 (offset 1 line).
patching file imapfront-auth.c
Hunk #1 succeeded at 31 with fuzz 1.
Hunk #2 succeeded at 57 with fuzz 2 (offset 2 lines).
Hunk #4 succeeded at 260 with fuzz 1 (offset 2 lines).
Hunk #5 succeeded at 291 (offset 2 lines).
Hunk #6 succeeded at 320 (offset 2 lines).
Hunk #7 succeeded at 379 (offset 3 lines).
patching file pop3front-auth.c
Hunk #1 FAILED at 28.
Hunk #2 succeeded at 42 with fuzz 2 (offset 3 lines).
Hunk #4 succeeded at 95 (offset 3 lines).
Hunk #5 succeeded at 127 (offset -1 lines).
Hunk #6 succeeded at 144 with fuzz 1 (offset 3 lines).
1 out of 6 hunks FAILED -- saving rejects to file pop3front-auth.c.rej
patching file smtp-commands.c
Hunk #1 FAILED at 1.
Hunk #3 FAILED at 112.
Hunk #4 succeeded at 266 with fuzz 1.
2 out of 6 hunks FAILED -- saving rejects to file smtp-commands.c.rej
patching file smtp-mainloop.c
Hunk #1 succeeded at 16 with fuzz 1 (offset 2 lines).
patching file ucspitls-stub.c
patching file ucspitls.c
patching file ucspitls.h

Thanks for all your help, starting to understand this a lot more
now...

Josh