Re: filtering ofmipd-submitted messages

On Thursday 01 Jun 2017 14:23:50 you wrote:
> I submit outbound mail through ofmipd with John R. Levine's SMTP AUTH
> patch[1]. (The service is available on the network only via stunnel.) It
> runs, like qmail-smtpd, as qmaild.

ofmipd + AUTH: FYI my ofmipd-plus also bases its' authentication on John 
Levine's SMTP AUTH, you may find it helpful to see what I've done,

http://free.acrconsulting.co.uk/email/ofmipd-plus.html

(see the text there re. TLS-capable version or more minimal non-TLS-capable 
version. If TLS, you'll need to track down ucspi-tls, you'll probably find it 
in the Internet Archive)

> I'm wanting to run submitted messages through custom filters before
> injecting them into the queue. Since this SMTP AUTH patch includes the
> QMAILQUEUE patch, no problem there.
> 
> Problem is, I'm wanting the custom filters to run as the authenticated
> user.
> 
> I'm thinking I want to make ofmipd more like qmail-pop3d by extracting
> the SMTP AUTH code out of ofmipd into a new "ofmipup" program (analogous
> to qmail-popup) that runs as root, calls checkpassword, and execs ofmipd
> as the authenticated user for the remainder of the "OFMIP" conversation,
> thereby ensuring that custom filters run as that user.
> 
> Is this architecture reasonable? In other words, since this is port 587,
> not port 25, is it reasonable to reject other SMTP commands (again,
> analogous to qmail-popup) until authentication has completed?

I'm not sure about the remainder of your questions though, it's too long since 
I produced ofmipd-plus.

cheers,

Andrew.
-- 
====================================================================
   * Custom email solutions * Systems Administration * Networking
	               http://www.acrconsulting.co.uk/
====================================================================