Re: mailfront on IPv6

--fwqqG+mf3f7vyBCB
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Jun 28, 2011 at 09:59:16PM -0400, Scott Gifford wrote:
> That is probably possible, but one of the security mechanisms I use in
> sslserver is chroot and switching to an otherwise unused UID, both of whi=
ch
> are only possible to root.  Providing the same security starting the proc=
ess
> afterwards would require a setuid root program, or for some kind of root
> credentials to be maintained in order to start up this separate process.

Right

> I guess it could be done with a separate SSL server and
> file-descriptor passing,

That's an interesting idea, though setting up an extra server could be a
nuisance.  It could run as a parent of tcpserver (or equivalent), which
wouldn't then require an extra server.

> but I'm not sure that could be easily shoehorned into sslserver.

No, it wouldn't need to be sslserver, since the requirements don't
require accepting connections and setting up the environment, just
handling the SSL protocol.

> Because sslserver implements the functionality of tcpserver plus SSL, it
> doesn't really carry around an extra process, it just carries around a co=
py
> of tcpserver that has some extra libraries loaded to provide SSL.

But it is still another PID, right?  So it has its own address space and
all.  Granted, most will be mapped from the parent process if I
understand right.

--=20
Bruce Guenter <[email protected]>                http://untroubled.org/

--fwqqG+mf3f7vyBCB
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)

iEYEARECAAYFAk4KnZcACgkQ6W+y3GmZgOhlqQCffh67bqRWohrIr0cVBoINovRa
g1kAnihe1ZFWWlzVdVvhhJQHDs4PQzP7
=rRHZ
-----END PGP SIGNATURE-----

--fwqqG+mf3f7vyBCB--