PMDF System Manager's Guide
PMDF-REF-6.0

Previous | Contents

24.2.3 Examples on UNIX

The following sections provide examples of using BSMTP channels on UNIX.

24.2.3.1 Configuring the BSMTP channels to compress their payloads on UNIX

Using PMDF's general purpose, on-the-fly conversion facilities, BSMTP parcels can be compressed on the sending system and then uncompressed on the receiving system. This allows for faster transmission of the parcels through the network.

In the CHARSET-CONVERSION mapping table on each PMDF system, a simple entry enabling conversions for the BSMTP channels must be made: 

CHARSET-CONVERSION 
 
  in-chan=bsout_*;out-chan=*;convert      yes 
  in-chan=*;out-chan=bsin_*;convert       yes

In the PMDF conversions file on each system, conversion entries are added which call out to the site-supplied shell script, compress.sh: 

in-chan=bsout_*; part-number=1; in-type=*; in-subtype=*; 
  service-command="/pmdf/bin/compress.sh compress $INPUT_FILE $OUTPUT_FILE" 
 
out-chan=bsin_*; part-number=1; in-type=application; 
  in-subtype=compressed-bsmtp; 
  service-command="/pmdf/bin/compress.sh decompress $INPUT_FILE $OUTPUT_FILE"
The compress.sh shell script is shown in Figure 24-4 . It assumes that the gzip and gunzip utilities are installed in /usr/local/bin/.

Figure 24-4 compress.sh:Compress and decompress BSMTP payloads 

#!/sbin/sh 
 
# compress operation in-file out-file [addr-file] 
 
# where 
 
#   operation   == "compress" | "decompress" 
#   input-file  == path of file to sign or verify 
#   output-file == output file to produce 
#   addr-file   == file of envelope recipient addresses 
 
if [ $# -lt 3 ]; then exit 1; fi 
 
case $1 
in 
  compress ) 
        /usr/local/bin/gzip < $2 > $3.tmp 
        /pmdf/bin/pmdf encode -nofilename -encoding=base64 -type=application \
                -subtype=compressed-bsmtp $3.tmp $3.tmp2 
        rm -f $3.tmp $3.tmp2 
        ;; 
 
  decompress ) 
        /pmdf/bin/pmdf decode $2 $3.tmp 
        /usr/local/bin/gunzip < $3.tmp > $3 
        rm -f $3.tmp 
        ;; 
 
  * ) 
        exit 1 
        ;; 
esac 
exit 0

24.2.3.2 Configuring the BSMTP channels to provide authentication services on UNIX

Using PMDF's general purpose, on-the-fly conversion facilities, authentication and integrity services may be tied in to the BSMTP channels. This is done through the CHARSET-CONVERSION mapping table, the PMDF conversions file, and a site-supplied shell script to digitally sign payloads and verify the signature and integrity of the data upon receipt.

In the CHARSET-CONVERSION mapping table on each PMDF system, a simple entry enabling conversions for the BSMTP channels must be made: 

CHARSET-CONVERSION 
 
  in-chan=bsout_*;out-chan=*;convert      yes 
  in-chan=*;out-chan=bsin_*;convert       yes

In the PMDF conversions file file on each system, there must be conversion entries to invoke the site-supplied shell scripts: 

in-chan=bsout_*; part-number=1; in-type=*; in-subtype=*; 
  service-command="/pmdf/bin/pgp_sign.sh $INPUT_FILE $OUTPUT_FILE" 
 
out-chan=bsin_*; part-number=1; in-type=multipart; in-subtype=signed; 
  service-command="/pmdf/bin/pgp_verify.sh $INPUT_FILE $OUTPUT_FILE"
These two scripts are shown in Figures 24-5 and 24-6 . They assume that the pgp utility is installed in /usr/local/bin/ and that awk is installed in /usr/bin/. Note that the pgp_sign.sh script requires the pass phrase for the PMDF MTA's private PGP key in order to generate signatures. Edit the script to reflect the correct pass phrase and be sure to protect the file from other users: 
% chown pmdf:bin /pmdf/bin/pgp_sign.sh
% chmod 0700 /pmdf/bin/pgp_sign.sh

Figure 24-5 pgp_sign.sh:Digitally sign BSMTP payloads 

#!/sbin/sh 
 
# pgp_sign.sh input-file output-file [addr-file] 
 
# where 
 
#   input-file  == path of file to sign or verify 
#   output-file == output file to produce 
#   addr-file   == file of envelope recipient addresses 
 
# Check that we have at least three command line parameters 
if [ $# -lt 2 ]; then exit 1; fi 
 
# Change these to match your site 
PGPUSER="PMDF MTA key" 
PGPPATH=/pmdf/table/pgp 
PGPPASS="Percy eats pealed banannas" 
 
# Generate the digital signature 
/usr/local/bin/pgp -sab $1 -u $PGPUSER -z $PGPPASS -o $2 +batchmode 
 
# Make some temporary files used to MIME-ify the results 
BOUNDARY=`/pmdf/bin/unique_id` 
echo 'Content-type: multipart/signed; boundary="'$BOUNDARY'"; '\
'micalg=pgp-md5; protocol=application/pgp-signature 
 
--'$BOUNDARY > $2.top 
echo '--'$BOUNDARY' 
Content-type: application/pgp-signature 
' > $2.mid 
echo --$BOUNDARY-- > $2.bot 
 
# Make a multipart/signed message part 
cat $2.top $1 $2.mid $2.asc $2.bot > $2 
 
# Now clean up 
rm -f $2.top $2.mid $2.asc $2.bot 
 
# And exit 
exit 0

Figure 24-6 pgp_verify.sh:Verify the integrity of a digitally signed BSMTP payload 

#!/sbin/sh 
 
# pgp_verify.sh input-file output-file [addr-file] 
 
# where 
 
#   input-file  == path of file to sign or verify 
#   output-file == output file to produce 
#   addr-file   == file of envelope recipient addresses 
 
# Check that we have at least three command line parameters 
if [ $# -lt 2 ]; then exit 1; fi 
 
# Change this to match your site 
PGPPATH=/pmdf/table/pgp 
 
# Use awk to split the multipart/signed part into 
# two files: the signed data and the digital signature 
/usr/bin/awk ' 
BEGIN { state = 0 } 
{ 
        if (state == 0) { 
                if (substr ($0, 0, 2) == "--") { 
                        boundary = $0 
                        state = 1 
                } 
        } else if (state == 1) { 
                if ($0 != boundary) { 
                        print $0 > OUT_DATA 
                } else { 
                        state = 2 
                } 
        } else if (state == 2) { 
                if (NF == 0) state = 3 
        } else if (state == 3) { 
                print $0 > OUT_SIGN 
        } 
}' OUT_DATA=$2.data OUT_SIGN=$2.sign $1 
 
# Verify the digital signature 
/usr/local/bin/pgp $2.sign $2.data +batchmode > $2.check 
 
# Build a X-Content-MIC-check: header line 
MICINFO=`grep -h ' signature from user ' $2.check` 
if [ -n "$MICINFO" ] 
then 
        echo 'X-Content-MIC-check: '$MICINFO > $2.mic 
else 
        echo 'X-Content-MIC-check: Bad signature' > $2.mic 
fi 
cat $2.mic $2.data > $2 
 
# Clean up 
rm -f $2.sign $2.data $2.check $2.mic 
 
# And exit 
exit 0

24.2.3.2.1 Using PGP with PMDF on UNIX

Note:

Use of PGP for commercial purposes requires a license from Pretty Good Privacy, Inc. Please contact Pretty Good Privacy, Inc. for details and assistance in licensing PGP.

Use of PGP requires installation of PGP as well as generation and exchange of PGP public keys between the PMDF BSMTP systems which will be using PGP for authentication. This section documents step-by-step how to generate and exchange PGP keys. No attempt is here made to document PGP. Please refer to the documentation supplied with PGP for information on those subjects.