OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: SMTP Auth
From: Brad Knowles (blkskynet.be)
Date: Tue Aug 22 2000 - 12:50:35 CDT

At 6:56 PM +0200 2000/8/22, Lutz Jaenicke wrote:

> For the postfix technique this would be a great gain. Postfix opens (security
> sensitive) files with root permission, then drops privileges and steps into
> chroot jail. All files that are to be opened after that change must
>be located
> inside the chroot jail _and_ must be readable to the postfix daemons (either
> be owned by the "postfix" account or world readable). The normal (uncritical)
> files like /etc/services are owned by root and world readable.
> Hence even if a postfix daemon would be compromised, it would not be possible
> to open new files outside the jail and those inside are protected against
> overwriting by ownership.

        It would also be really cool if the SASL authentication process
were handled by a daemon listening on a Unix port, with simply
library routines available to access the authentication daemon by
other processes. This would give you a persistent daemon that could
do connection caching and multiplexing, it could be multi-threaded,
etc.... The performance gains would probably be *quite* significant.

> Postfix also features its own database routines which can detect database
> changes, so that the respective daemon will shutdown and a new daemon
> can be started to connect to the changed database, this making it rather
> uncritical that the files are opened once and stay open.

        Right, the SASL authentication daemon would need the same sorts
of capabilities. 

--
   These are my opinions -- not to be taken as official Skynet policy
======================================================================
Brad Knowles, <blkskynet.be>                || Belgacom Skynet SA/NV
Systems Architect, Mail/News/FTP/Proxy Admin || Rue Colonel Bourg, 124
Phone/Fax: +32-2-706.13.11/12.49             || B-1140 Brussels
http://www.skynet.be                         || Belgium

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.