| Previous: Chapter 6 | Book Review: Qmail Quickstarter | Next: Chapter 8 |
Chapter 7 describes advanced features such as encryption of email during transport (via SSL or TLS) and providing mailing-list services.
After introducing Secure Sockets Layer (SSL) and Transport Layer Security (TLS), a well-written paragraph on the dilemma of choosing between patching or wrapping a qmail component, which should probably have appeared earlier in the book, precedes short descriptions of various ways to support SSL/TLS for incoming (SMTP) mail.
The receiving and sending sides of encrypted email transport
are then covered.
Important security issues for the receiving (qmail-smtpd)
side are explored, although those involving potentially exposing
private server keys to an Internet-facing component (which are not trusted
by the qmail security model), such as qmail-remote,
are not explored.
(That is, user qmailr presumably has access to the
email server's private keys, because qmail-remote,
as typically patched to send encrypted mail, needs them.
But qmail-remote also parses untrusted input from
the Internet, which is why it runs as the unprivileged user qmailr;
so, if exploited — much more likely once patched to support SSL/TLS — it
could possibly be convinced to expose the server's private keys in
some fashion.)
The information on mailing lists is well-presented and should serve as a good start for anyone looking into using qmail for their mailing lists (something I've not yet done for myself).
Under "SSL Encryption", on Page 108, the second-to-last paragraph in the section beginning "There are many forms", in the last sentence beginning "As such", change "it can be added to an SMTP server without requiring the server's clients" to "it can be supported by an SMTP server without requiring all of the server's clients".
Nits: Under "Patch vs. Wrapper" on Page 108, in the second paragraph, remove ", of course,", as it's a bit gratuitous.
Under "When Receiving Email", on Page 110 in the last paragraph in the section (top one on that page), the last sentence should use "might" where it uses "may".
Under "Efficiency under Load" (should "under" be capitalized?),
on Page 113 in the section's only paragraph (should it be broken
up into digestible chunks?), in the sentence beginning "On the other hand",
insert "whereas" before "GNU Mailman's mailman program".
| Previous: Chapter 6 | Book Review: Qmail Quickstarter | Next: Chapter 8 |
Copyright (C) 2007 James Craig Burley, Software Craftsperson
Last modified on 2007-07-10.