OPENPGP DNS & Milter

 # yum install hash-slinger

 # rpm -qil hash-slinger

Name        : hash-slinger
Version     : 2.7
Release     : 1.el7
Architecture: noarch
Install Date: Fri 22 Jan 2016 10:12:33 AM CET
Group       : Applications/Internet
Size        : 88902
License     : GPLv2+
Signature   : RSA/SHA256, Sun 03 Jan 2016 04:05:07 AM CET, Key ID 6a2faea2352c64e5
Source RPM  : hash-slinger-2.7-1.el7.src.rpm
Build Date  : Sun 03 Jan 2016 01:34:40 AM CET
Build Host  : buildppcle-05.phx2.fedoraproject.org
Relocations : (not relocatable)
Packager    : Fedora Project
Vendor      : Fedora Project
URL         : http://people.redhat.com/pwouters/hash-slinger/
Summary     : Generate various DNS records such as RFC-4255 SSHFP and RFC-698 TLSA
Description :
This package contains various tools to generate special DNS records:

sshfp       Generate RFC-4255 SSHFP DNS records from known_hosts files
            or ssh-keyscan
tlsa        Generate RFC-6698  TLSA DNS records via TLS
openpgpkey  Generate draft-ietf-dane-openpgpkey DNS records from OpenPGP
            keyrings
ipseckey    Generate RFC-4025 IPSECKEY DNS records on Libreswan
            IPsec servers

This package supersedes 'sshfp' and 'swede'
/usr/bin/ipseckey
/usr/bin/openpgpkey
/usr/bin/sshfp
/usr/bin/tlsa
/usr/share/doc/hash-slinger-2.7
/usr/share/doc/hash-slinger-2.7/BUGS
/usr/share/doc/hash-slinger-2.7/CHANGES
/usr/share/doc/hash-slinger-2.7/COPYING
/usr/share/doc/hash-slinger-2.7/README
/usr/share/man/man1/ipseckey.1.gz
/usr/share/man/man1/openpgpkey.1.gz
/usr/share/man/man1/sshfp.1.gz
/usr/share/man/man1/tlsa.1.gz

$ openpgpkey --fetch --uid 2 michael@nausch.org

-----BEGIN PGP PUBLIC KEY BLOCK-----                                                  
Comment: michael@nausch.org key obtained from DNS                                     
Comment: key transfer was protected by DNSSEC                                         
Version: GnuPG v2.0.22 (GNU/Linux)                                                    

mQINBFI9/U0BEACfpc7ClI9gjdYZ4dU4oRq7OytIMJCqd9f/82zXLav2R282a+Ne
k997kartujdknbuAsVKpqh4kVjj7SA1/4ITkuE+d7Ski2XZZVAJQlqXgpqVmCP2w
Gq2zODnopuueIp0VZlKc+WlspS0NGfNiIrywEEt7joL25YqgDwejsmYiWlbd3Qnh
TKqlAXn6g7VZA1Bk3K7OBkV6RY7vlIrKmeefHkLrU4B2+02Two2w4tP15l9iXOUT
o/6bdnJYzcnGWU2cavmpxF6VoSId984rgIWNvqsJbvD+T5/fKh1ev8GfIcIANYbg
v0QJlplFXIvIyMJMnrKD7z+AmuACwZoAUnG9IXipb439axPje1lQMN/qpXxxzumQ
lsc+ctGAOmPrIVBZaeBznu5bMx+l0y2nb/dNY3mNywED4ixiCEYYez1QlXN/1NZN
Oo5ZFY/0ZIv+pPUF1+Th77LOo8vL7fUBKQCz1SdsZB5whe0z4GYQp8qHfJLm2Trm
Tmyfcs71HdUGOcr2D++HPjF6XFOPvmJ/MXEWNPYL4ne/1dvkJJIkya8B7+nXKvKs
ot/MWXEcuC2q9MaLbDGjNKqagJTrPmZavi5nAuQgfGbQCmDrbDX+DaX1TmTMtQ0h
ceDbEnuV5J0+OdZRwQurZdbDA0w7N+6Q7hdPKS6pCjQEJXGHthz1ojO0qQARAQAB
tCNNaWNoYWVsIE5hdXNjaCA8bWljaGFlbEBuYXVzY2gub3JnPokCPQQTAQgAJwUC
Uj39TQIbAwUJBKKGAAULCQgHAwUVCgkICwUWAwIBAAIeAQIXgAAKCRAHTs9hUKa/
7bVYD/wLgjtz9l3tsyPbuqG3d9vqSfwCcHyMXako+fB3Llq3ImOmJ2YoYYGCmx6m
FF2zzK3HeiofyVTAMkYtLxZcmAQw32YtTvSEa9RyibOl21ayCuVyeYSpjcsOYglS
G3I82uPpMj8ob/ich3QARqU1EPpCMqQsxPnP9At6glcldZ2BIK6poDdGnHwS0JKJ
zqQ8ImKNJlA8CfuRTGlpaxoh3VP0sjKIUhqC3yuw64fAU/gl5KGQVzp9jFgWKqw4
hHKhdwMj9gmh/MkvmaL/cITSh3uTcs/xEL/e9keTPQ8E3JbiGy2UuChJdwHoYE//
6RUP5XXpHPgcl8ffQJEq51rZHs8YXWQnFvGL9+T2YK2AXPrEHP1FeS8MWTX1GKWa
Rs4r5Ax5iosw+h/1dDRd6Ph3z2dD+QIbLg2t8ALtzbKUr1rsQ9NrLta1zt7P4lj3
Qr0PCwWMp9QXw/nkIiSYmfxuzUWE3oR1H2W7Ol2jSzslW2RBOpqVSd7bwyNUGg3t
AWGCvRSSucBV+nCr1/r+HpnFIWm6rkpQKjbozt+4z+CoozytNLD/jwAoTBukSOmN
5vEpukoRLYmLiNhsfm1wJeqjhCvfrec48t1jLYQDkC+O2+uuVMvbdA6eR8T1WCpk
lxcnyP0KZbRellLoFzxQbQl6rBU1I1axyxz4VbkXzEfRISeaDLQ2TWljaGFlbCBO
YXVzY2ggKGFrYSBEamFuZ28gW0JPZkhdKSA8ZGphbmdvQG5hdXNjaC5vcmc+iQI9
BBMBCAAnBQJSPgXoAhsDBQkEooYABQsJCAcDBRUKCQgLBRYDAgEAAh4BAheAAAoJ
EAdOz2FQpr/t+4sP/jRt0dc5fTM5ZaZ7Dnmb1K5O9XR7T5ByLbflHb27LRWNkYEk
jsKoJ6Z/h8E59r5d6zR13UeW2LTr7THU3uk70s0BAEBkI5HkI1MMYX3ZhVK8W5mi
gWpNIT7gXa7ngfipgrVXZGUZwU0roRdqZ1CZ94e76FtYUjMNnZ6KlbPJQZCN3S/w
91DoQGCJrVpWqNOTHB5nZaHFGyWWdIAYBr5pjFboHzTGtYU1W6y248bmUafIyBk6
Z6p4oMVyPsGFes7IRseUBJhClEPYYCY8+fFbmpGTvfpHM5X/zIdJqQAk7OX9ttlw
o4MskoQHNKz5kDzIF4uDUNIQq8ZkoxvuiPlaZsk4/AiCAwM+D0rng88/i0sbxxRi
iuEuqz+MdtQQz3TwogVc2VPC5JtrQEWWC9cikTVX71l9DpisP/uwC0/LtmnmSLix
h/zLN75SJ/PCfZbaT6r8ANob5+LxX/MHdfyv54qQaPlB4w2UDc0QJSPB2+bR2wDq
ueJRp92M93WaQzvxsTD6kurPxkvTTlaGo7LHf/04flvRNILH1mdavvFO+DKrat2w
C5NITtBaLcXiJvAmZS3ZfhSsiK8YdQF+BJi+B7mjZGqcqUT+gZsPKQuahcX+2SbE
2X0ID5QznRmX1HWCm+CQcATaErNTJT+Ika037kDN2kq233H4UTOIZcHLjV/ntDNN
aWNoYWVsIE5hdXNjaCAoYWthIEJpZ0NoaWVmKSA8YmlnY2hpZWZAb21uaTEyOC5k
ZT6JAj0EEwEIACcFAlI+BiACGwMFCQSihgAFCwkIBwMFFQoJCAsFFgMCAQACHgEC
F4AACgkQB07PYVCmv+1jFA//XPJSEQkXdsHlMfofK7cUG5ZU6LZwU1zfi5hbYizc
1z6rD3+5v4HS7Oz7nUv8SOYkB/ot99AXfqgbh6Iin3RfRi5gSx1DJuhRNhzOW+1F
ocjYPXHvWdGLVmbwCmPLjoA72ct4SH4gyLRNZH0dvUPT8vfXEKRIaiCNB7ht93UJ
XcDn97DY54q+EfxkywVmlK1EYmNN+3EUuBPNVpumC+6Zy3u/plphxUZa6LEZEihp
I+d2EPSBOw1MYihYfqYLRKGziTTEJmvUEt5pnI5S9uE0IqedAOUTdjwhOnzyJk+P
ulEGnhtoJ1v0DIYEYiIEaVPIp8Pax151QbnYDSPIe+WlOpbG3C1Yb8CTz65FpcwS
jG84GjoTrapePWj07PwwAC5+/Yvqr1AAKIzqEJkfIv5qW5OCwAWkChL3rATWyDaP
HwYStsZ3Xgn/oUkx7StOstwqqrdmd0vJJKKnMYV9wjE/W0SYoT0UDwzK0XSUCFPN
rHCHML0CINa7/rX9NYCSX6K55APnslqoHh1c1gIhaZ2srs7sryfTDy65V32Stxg7
oAXO9DJn6AcgAJHSpopQJgTqfez8djL5j34kjiGXncqv3CZNDiVzeoTTjDG41Rmy
HhSUKpyo8WGkvmhIXWzbcMrxEueclyppMgSqb2JCl0iIFu1Uu7Wg7qRPygZLXAdT
kuq5Ag0EUj39TQEQAMIfFbJQ8x/gRrmRRlO3AmSHZfI1I0+OU97iXhYPDc5ncWh+
BWYq1q2j3NiQAljpWyc4sX/uJtPtsiTms7hp4P8H0zlHGZHiGDRZ/kWn7j7mioaY
6/8tXBM07hRe21rngt247icBRX927RnHO813JaNjb6/aEpyO9qkOr2SrQfBSysbd
1XNc/I4cxGEUCqghJcrh6fcYA1z4Pek6UBziBocSPSZ4hfXEE4pS4P0l1OQpEngT
pTb4jKRClj2grOyUfyPs4vLbWta5T4H2JLsD289JmRSOFu9KRQwqc0hDHnYFs1Uu
90HPJHzQ/BIrOdGUfnjzsOcL5CUQDi/09Mm2Duz6F3U8WyIc6vLTAG8ciFkAGTj0
VcwjHFdq7uijJrjkzl3LI3OC7wIX5XDk2kTh2fmp/dEo5LAjfJHUimQKDibkznJt
suLWlgJD6MorOB8qyA3hSjAhA/I6sqGd/nbHsFTvJWB/VPjXxDHIYGfEG55ur5rD
O6xEALS8SKruVL97avxulLQ5X1vc7JgM1C/AF7L6wCQAfa7QkGoBDvLZyKOsCxxi
ELotiG1QaGtocgH2dNnDklwx4RJ0W5IJGxei9fUA2YOvy9SvAYINpmWKZJuDiiNO
YR5OjcywXvTcYglxgcDwpSk0xw/IKjZevR90/xIItWGAkFpsOqv6s2i6npE5ABEB
AAGJAiUEGAEIAA8FAlI9/U0CGwwFCQSihgAACgkQB07PYVCmv+3glQ//VpUYontl
CsnPPrEUZNYbdvawm4EN0jEtNYc0EFY/13shsHEBX+x28HzqE3M87B5xBU5KNwkE
VKZVK1CYKJ5kG8Gv3sTzlTbvC1i1xFH9HO+NZFQqG1WupG8zVKsLJoIHUkplA7lO
ZfA0z262VH4JJaQU6tv7WQXbEEaXUpa0hsoJmvei/ShaYpDZiDhl6dVbDGw3hJ54
t4H1YQGZk7sely/DyUXhmRlyTqB6AH4ZFGDeysQk4D1iPqGnhCOJnsyJ/UwRRdSn
kUjAF8EB3kw2cyB++LgOyrqVFbxkO/JTepDDWwfzAlcQ18dc/DBhdOVNhLH7AFxp
CS+64+snMskT88mvkRkcc7OBYhITKnn2XDuSBkWiw6UAFFoKgb1ZCBnMMnG086ZD
WMLZkCQ1nL8pX7wPdyUU9YP9U5YvTYeuCrNpNy7xM3l5BEFK/Y91fygnvy4UBtJ0
LymqM80MuSVRgQrFdxJAFgHN+ziRw9v+VRijWzmufeHkqUo77BVot9mDmouAiUGw
cK1hGL0Nl34rgN6gOETPzGLiOLBmytVW/fGZ0hwerRuE7rk0W5lapE2lQeQPjCiL
2LeJPxcPjsBJa3h05QwIaZo18Wb9esnjBjzjV4fRY0+akiJw/w6+V893FGbZnHIv
/cDg8Z+10RIiBZa9qC50NNTfhPD70lV+HRc=
=usnJ
-----END PGP PUBLIC KEY BLOCK-----

 # yum install openpgpkey-milter -y

 # rpm -qil openpgpkey-milter

Name        : openpgpkey-milter
Version     : 0.5
Release     : 1.el7
Architecture: noarch
Install Date: Fri 29 Jan 2016 12:35:15 PM CET
Group       : System Environment/Daemons
Size        : 50233
License     : GPLv3+
Signature   : RSA/SHA256, Mon 04 Jan 2016 04:56:06 PM CET, Key ID 6a2faea2352c64e5
Source RPM  : openpgpkey-milter-0.5-1.el7.src.rpm
Build Date  : Mon 04 Jan 2016 01:08:27 AM CET
Build Host  : bvirthost02-nfs.phx2.fedoraproject.org
Relocations : (not relocatable)
Packager    : Fedora Project
Vendor      : Fedora Project
URL         : ftp://ftp.nohats.ca/openpgpkey-milter
Summary     : OPENPGPKEY basd automatic encryption of emails using the milter API
Description :
The openpgpkey-milter package provides a milter plugin for sendmail or postfix
that will automatically encrypt plaintext emails if the target recipient is
publishing an OPENPGPKEY record protected with DNSSEC. This is currently an
IETF draft (draft-wouters-dane-openpgp)
/etc/tmpfiles.d/openpgpkey-milter.conf
/usr/lib/systemd/system/openpgpkey-milter.service
/usr/sbin/openpgpkey-milter
/usr/share/doc/openpgpkey-milter-0.5
/usr/share/doc/openpgpkey-milter-0.5/LICENSE
/usr/share/doc/openpgpkey-milter-0.5/README
/var/run/openpgpkey-milter
/var/run/openpgpkey-milter/openpgpkey-milter.sock
/var/spool/openpgpkey-milter

 # less /usr/share/doc/openpgpkey-milter-0.5/README

WARNING
=======

This is pre-release software. It's only been testing by me on my personal
postfix server. Running this anywhere on a production machine might cost 
you your job, although afterwards please do let me know how it failed you
so I can fix it.                                                         

openpgpkey-milter
-----------------

openpgpkey-milter is a sendmail/postfix milter service that will attempt
to automatically OpenPGP encrypt plaintext emails received by the MTA/MUA
before relaying the message further towards the recipient(s). These can be
messages received from the network, or generated locally.

Requirements
------------
Apart from requiring a milter compatible mail server (postfix or sendmail),
openpgpkey-milter requires:

* python-unbound / unbound-python (in all major distros)
* python-milter / python-pymilter (in all major distros)
* [python-gnupg](http://pythonhosted.org/python-gnupg/)
  (older versions might need a [patch](http://code.google.com/p/python-gnupg/issues/detail?id=94)
* gnupg, libmilter, etc which are dragged in dependancies by the above packages

Recommended
-----------

The [hash-slinger](http://people.redhat.com/pwouters/hash-slinger/)
package contains an "openpgpkey" command that allows you to generate and
verify your own OPENPGPKEY records.

How does it work
----------------

openpgpkey-milter detects when a message is not encrypted with gpg and
then checks all the recipients to see if they published the special
[OPENPGPKEY](http://tools.ietf.org/html/draft-ietf-dane-openpgpkey) DNS record.

Configuration of the milter service
-----------------------------------

To use openpgpkey-milter with postfix, add to `/etc/postfix/main.cf`

     smtpd_milters = inet:127.0.0.1:8890
     non_smtpd_milters = $smtpd_milters
     milter_default_action = tempfail
     milter_protocol = 2

If you run `opendkim`, ensure you add openpgpkey-milter **before** opendkim
or you'll break the opendkim signatures. For the fedora/rhel configuration
where opendkims uses port 8891, you can use the following:

     smtpd_milters = inet:127.0.0.1:8890, inet:127.0.0.1:8891
     non_smtpd_milters = $smtpd_milters
     milter_protocol = 2
     milter_default_action = accept

Mailing list and bug reports
----------------------------

There is no mailing list yet. Please send questions and bug reports
to paul@nohats.ca. However if you run openpgpkey-milter on your mail
server and it broke, you might be better of mailing me at the unsigned
domain paul@cypherpunks.ca.

nix zu tun

 # vim /etc/tmpfiles.d/openpgpkey-milter.conf

/etc/tmpfiles.d/openpgpkey-milter.conf

D /var/run/openpgpkey-milter 0770 root mail -

 # systemctl start openpgpkey-milter

 # systemctl status openpgpkey-milter

● openpgpkey-milter.service - OPENPGPKEY auto encryption milter
   Loaded: loaded (/usr/lib/systemd/system/openpgpkey-milter.service; disabled; vendor preset: disabled)
   Active: active (running) since Fri 2016-01-29 12:45:19 CET; 22s ago
 Main PID: 3880 (openpgpkey-milt)
   CGroup: /system.slice/openpgpkey-milter.service
           ├─3880 /usr/bin/python /usr/sbin/openpgpkey-milter
           └─3886 /usr/bin/python /usr/sbin/openpgpkey-milter

Jan 29 12:45:19 vml000087.dmz.nausch.org systemd[1]: Started OPENPGPKEY auto encryption milter.
Jan 29 12:45:19 vml000087.dmz.nausch.org systemd[1]: Starting OPENPGPKEY auto encryption milter...
Jan 29 12:45:20 vml000087.dmz.nausch.org openpgpkey-milter[3880]: openpgpkey-milter: failed to setproctitle - python-setproctitle missing?
Jan 29 12:45:20 vml000087.dmz.nausch.org openpgpkey-milter[3880]: starting daemon [3880] version 0.5 on port 8890 at /var/spool/openpgpkey-milter with timeout 600