popa3d-users - Re: Question about using popa3d and stunnel

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20021223115210.2ad7daa6.daniel.leite@ccg.pt>
Date: Mon, 23 Dec 2002 11:52:10 +0000
From: Daniel Leite <daniel.leite@....pt>
To: popa3d-users@...ts.openwall.com
Subject: Re: Question about using popa3d and stunnel

On Sun, 22 Dec 2002 18:54:49 +0100
Peter van Dijk <peter@...aloss.nl> wrote:
> On Sun, Dec 22, 2002 at 07:20:51PM +0300, Solar Designer wrote:
> [snip]
> > It's a really good idea to have stunnel running as a dedicated
> > pseudo-user (I don't know if this still requires patching, it used
> > to).  There have been numerous security holes discovered in both
> > stunnel itself and in OpenSSL that it uses.
> 
> >From the manpage:
>        -s username
>            setuid() to username in daemon mode
> 
>        -g groupname
>            setgid() to groupname in daemon mode. Clears all other
>            groups.

	the last version of stunnel (4.03) you can define with uid and
	guid it runs... also it runs in a chroot (although i still didnt
	understand when exactly it moves to the chroot jail)


	here is my config for the latest stunnel for pop3s imaps and
	ssmtp:

cert = /usr/local/etc/stunnel/stunnel.pem
chroot = /var/run/stunnel/
pid = /pid/stunnel.pid
setuid = stunnel
setgid = stunnel

[pop3s]
accept  = 995
connect = 110

[imaps]
accept  = 993
connect = 143

[ssmtp]
accept  = 465
connect = 25

	the stunnel is a group and user JUST for stunnel
	the /var/run/stunnel must have a etc/hosts.allow and
	a etc/hosts.deny for proper tcp filter

	i also created a pid directory owned by stunnel for the pid file
	creation (the chroot,etc and its files are root owned)

	i start stunnel in rc.local with
	/usr/local/sbin/stunnel /usr/local/etc/stunnel/stunnel.conf

	This works fine, the client must use SSL connection for pop3,
	imapd and smtp (used sylpheed claws to test it)

	hope this helps

higuita
-- 
Daniel Mota Leite
Gestor de Sistemas/System Manager
  Centro de Computação Gráfica            Tel: +351 253 439 300
  Rua Teixeira de Pascoais 596            Fax: +351 253 439 348
  4800-073 Guimarães Portugal
CCG and University of Minho are Members of the INI-GraphicsNet

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.