Re: mailfront on IPv6

--20cf307c9d6014cd3a04a66b6b72
Content-Type: text/plain; charset=ISO-8859-1

On Thu, Jun 23, 2011 at 8:10 PM, John R. Levine <[email protected]> wrote:

>  I guess that an IPV6 patch for sslserver would be all I need (apart from
>> an IPV6 capable network) to get it to work. Here is one:
>> http://www.brandonturner.net/**blog/2009/08/qmail-ipv6-**sslserver/<http://www.brandonturner.net/blog/2009/08/qmail-ipv6-sslserver/>
>>
>
> The FreeBSD port of ucspi-tcp says that the ssl and ipv6 patches are
> incompatble.  Oh, well.
>
> This week I smooshed the ipv6 qmail patches on top of other patches
> including outgoing ssl and AUTH. I suppose I could do it for ucspi, but I'd
> rather make it work in mailfront rather than a separate process.


IMO there are substantial security advantages to running the SSL processing
in a separate process.  Primarily, it allows SSL processing to be isolated
inside a low-privilege chroot jail, so that any security flaws in
OpenSSL<http://web.nvd.nist.gov/view/vuln/search-results?query=openssl&search_type=all&cves=on>
are
contained. OpenSSH uses a similar privilege separation
strategy<http://www.citi.umich.edu/u/provos/ssh/privsep.html> to
mitigate security risks.  My ucspi-tls
patch<http://www.suspectclass.com/sgifford/ucspi-tls/> to
sslserver implements this privilege separation through chroot and setuid.
 Also, SSL has a tricky programming model, and better to re-use the work
already done in ucspi-ssl to get this all right then to try and re-implement
it under mailfront.

The blog post above doesn't talk about adding support for both ssl and ipv6
to tcpserver, but about adding ipv6 support to sslserver.  Assuming that
works, it shouldn't be too hard to throw my ucspi-tls patch into the mix.
 I'd be happy to help if you run into trouble.

Of course, I may be a bit biased in this whole thing.  :-)

------Scott.

--20cf307c9d6014cd3a04a66b6b72
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Thu, Jun 23, 2011 at 8:10 PM, John R. Levine <span dir=3D"ltr">&lt;<a hr=
ef=3D"mailto:[email protected]">[email protected]</a>&gt;</span> wrote:<br><div c=
lass=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=3D"margin:0 0 =
0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im"><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .=
8ex;border-left:1px #ccc solid;padding-left:1ex">
I guess that an IPV6 patch for sslserver would be all I need (apart from<br=
>
an IPV6 capable network) to get it to work. Here is one:<br>
<a href=3D"http://www.brandonturner.net/blog/2009/08/qmail-ipv6-sslserver/"=
 target=3D"_blank">http://www.brandonturner.net/<u></u>blog/2009/08/qmail-i=
pv6-<u></u>sslserver/</a><br>
</blockquote>
<br></div>
The FreeBSD port of ucspi-tcp says that the ssl and ipv6 patches are incomp=
atble. =A0Oh, well.<br>
<br>
This week I smooshed the ipv6 qmail patches on top of other patches includi=
ng outgoing ssl and AUTH. I suppose I could do it for ucspi, but I&#39;d ra=
ther make it work in mailfront rather than a separate process.</blockquote>

<div><br></div><div>IMO there are substantial security advantages to runnin=
g the SSL processing in a=A0separate=A0process. =A0Primarily, it allows SSL=
 processing to be isolated inside a low-privilege chroot jail, so that any=
=A0<a href=3D"http://web.nvd.nist.gov/view/vuln/search-results?query=3Dopen=
ssl&amp;search_type=3Dall&amp;cves=3Don">security flaws in OpenSSL</a>=A0ar=
e contained. <a href=3D"http://www.citi.umich.edu/u/provos/ssh/privsep.html=
">OpenSSH uses a similar privilege separation strategy</a>=A0to mitigate se=
curity risks. =A0My=A0<a href=3D"http://www.suspectclass.com/sgifford/ucspi=
-tls/">ucspi-tls patch</a>=A0to sslserver implements this privilege separat=
ion through chroot and setuid. =A0Also, SSL has a tricky programming model,=
 and better to re-use the work already done in ucspi-ssl to get this all ri=
ght then to try and re-implement it under mailfront.</div>

<div><br></div><div>The blog post above doesn&#39;t talk about adding suppo=
rt for both ssl and ipv6 to tcpserver, but about adding ipv6 support to ssl=
server. =A0Assuming that works, it shouldn&#39;t be too hard to throw my uc=
spi-tls patch into the mix. =A0I&#39;d be happy to help if you run into tro=
uble.</div>

<div><br></div><div>Of course, I may be a bit biased in this whole thing. =
=A0:-)</div><div><br></div><div>------Scott.</div><div><br></div></div>

--20cf307c9d6014cd3a04a66b6b72--