tlug: Re: [sendmail-security@example.com: Sendmail Workaround for Linux Capabilities Bug]

["Stephen J. Turnbull" <turnbull@example.com>]

>>>>> "sb" == SL Baur <steve@example.com> writes:

    sb> Simon Cozens <simon@example.com> writes in tlug@example.com:
    >> I've been meaning to look into postfix, but all the articles
    >> I've read about it make it sound fiendishly complex,

    sb> "Fiendishly complex" would be overstating it, I believe.  The
    sb> version I looked at was more complex to configure than
    sb> sendmail though.

    >> and complexity isn't always a virtue when security is
    >> concerned.

    sb> When is it ever a virtue (wrt security)?

When you're out and want to get in.  Isn't that obvious?  :-9

More seriously, if you want to have a complex policy, then complex
configuration will be required.  Eg, open relay vs. no relay is
simple to configure, but unacceptable for a gateway machine.

To implement arbitrary policy, you need Turing capability in your
enforcement engine.  It doesn't get more complex than that ;-)

All you can do is make it easy to implement certain common complex
policies.  If you insist on a simple configuration language, then
other complex policies will be unimplementable.

-- 
University of Tsukuba                Tennodai 1-1-1 Tsukuba 305-8573 JAPAN
Institute of Policy and Planning Sciences       Tel/fax: +81 (298) 53-5091
_________________  _________________  _________________  _________________
What are those straight lines for?  "XEmacs rules."
-----------------------------------------------------------------------
Next Meeting (w/ YLUG): June 16 (Fri) 19:00 Mizonoguchi Marui Family 12F
Next Technical Meeting: July 8 (Sat)  13:30 Topic: TBA
-----------------------------------------------------------------------
more info: http://www.tlug.gr.jp        Sponsor: Global Online Japan