Szerző: Bill Hacker Dátum: CC: exim-users Tárgy: Re: [exim] Uid used to access TLS-certificates
Tony Finch wrote:
> On Fri, 11 Feb 2005, Timo Neuvonen wrote:
>
>>Now user 'exim' seems to be used to read the certificate files.
>>Is there any way to make exim to read the certificates as root? Exim
>>executable is setuid to root, so it should be possible, I think.
>
>
> No: Exim doesn't read the certificate until the last possible moment, at
> which point it has thrown away all privilege. You can restrict readability
> of the certificate to the Exim user to hide it from other users.
>
> (It would probably be safer if Exim had an option to load the certificate
> at startup, and prompt for any passphrase; the cert would then be secure
> against compromise of the exim user.)
>
> Tony.
Hmmm.....
'What if'...
- The path to the cert was an SQL call (cert being stored in the DB)
AND
- the connecting IP was passed as part of the "SELECT ...."
Might that not provide both a means of storing an already unlocked cert
(somewhat) more securely
AND
- providing the cert that matched the domain the IP was assigned to in
multi hosting environments?