How do you setup your binkp for TLS?
i'm using haproxy for incoming connections, stunnel should also work
in the binkd nodelist:
node 5:6/7 -pipe "ncat --ssl-alpn binkp *H *I" example.com:24553
My reply could have been a little bit longer, I'm trying again with some more details, even stuff many already know ... :)
Preface: TLS and SSL are often used synonymously. SSL is the older standard that is deprecated and replaced by TLS. Many applications still use SSL in their name, with command line paramaters, configuration options or in the documentation. They always use TLS by default (there might be some rare exceptions). So if you read SSL it means TLS most of the time (the last SSL version 3.0 is from 1996, TLS 1.0 from 1999, 1.2 from 2008, 1.3 from 2018). For
some aesthetic or habitual reasons I also like "SSL" better than "TLS".
There are basically two ways to start a TLS session:
1) Implicit (or direct) TLS: client and server directly start the TLS session, after the connection has been established.
2) Opportunistic TLS: client and server start with an unencrypted cleartest connection and after some chit chat, they agree to upgrade the connection to TLS. (For SMTP, IMAP, NNTP, XMPP, IRC and other protocols it is know as STARTTLS).
https://en.wikipedia.org/wiki/Opportunistic_TLS
Until recently STARTTLS was the prefered method to enable smooth transitions from unencrypted to TLS encrypted connections without any involvement from the user. Since the Snowden leaks in 2013 a lot has changed and the IETF is pushing
towards implicit TLS now ("Cleartext Considered Obsolete":
https://tools.ietf.org/html/rfc6409).
As far as I know (and I might be wrong, please correct me), the only binkp mailer that supports TLS is MysticBBS. It's not documented, but the wiki states
that it is "opportunistic SSL (TLS v1.2+) using a proprietary extension of the
BINKP protocol". I guess it would not be very hard to reverse engineer the binkp extension, if you capture the data of a binkp session between two MysticBBS instances. Or wait until the author releases a documentation. Then support for the opportunistic TLS extension could be added to other mailers too.
Honestly, I think we should forget about opportunistic TLS for binkp. Implicit TLS is simpler to implement, does not have the weaknesses of opportunistic encryption and can be added to servers that don't support TLS natively.
To add TLS support to a binkp server you need a so called TLS termination proxy
for TCP connections. Servers that offer that functionality are stunnel, nginx and haproxy. The proxy server listens on another port (let's say 24555) for incoming TLS connections from the internet and forwards them in cleartext to your local binkp server on port 24554.
Setting up TLS for the server side is quite straight-forward and should work with any binkp server. I would recommend stunnel, it is easy to configure. The most powerful is haproxy, but it has a million configuration parameters you'll never use and a weird config syntax. Nginx might be interesting, if you're already using it (I haven't tried the tcp proxy in nginx).
Maybe a step-by-step howto would be useful.
And then there is the other side: how to make a TLS connection from a binkp client? That is a post for another day ...
* Origin: ِ (21:1/151)