Gavin Brown's questions

Is it possible to configure Apache (or any other SSL-aware server) to only accept connections from clients presenting a certificate from a pre-defined list? These certificates may be signed by any CA (and may be self-signed).

A while back I tried to get client certificate validation working in the EPP system of the domain registry I work for. The EPP protocol spec mandates use of "mutual strong client-server authentication". In practice, this means that both the client and the server must validate the certificate of the other peer in the session.

We created a private certificate authority and asked registrars to submit CSRs, which we then signed. This seemed to us to be the simplest solution, but many of our registrars objected: they were used to obtaining a client certificate from a CA, and submitting that certificate to the registry. So we had to scrap the system. I have been trying to find a way of implementing this system in our server, which is based on the mod_epp module for Apache.

It's always annoyed me that while the sockets for network, serial, parallel and display cables all have securing mechanisms (ie a screw-in bolt, or a clasp) to stop them from being pulled out by jostling, there's nothing similar on power sockets (ie IEC 60320 C13 and C14 connectors). It seems to me that while accidentally knocking out a server's network cable is bad, it's nothing like as bad as accidentally knocking out its power.

Using power distribution units/UPS systems actually increases the risk of this happening because you then have two poorly secured sockets per machine, rather than one.

Is there any reliable, standards-compliant and relatively cheap way of securing C13/C14 connectors? I'm thinking about the sort of thing I can epoxy on the back of the servers that will hold the power cable securely. Are there any manufacturers who build something like this into their chassis?

I'm looking to replace our aging mail server and I've decided that I want to change the SMTP server software we use. We currently run exim. Over the years I've worked with a number of other MTAs (namely Postfix and Sendmail), and in my opinion, they all suck as far as configuration is concerned: they're all arcane, fiddly and inelegant, at least compared to the other mission-critical daemons I have to work with on a daily basis (Apache, MySQL, Dovecot, etc).

Our mail server does not handle much volume (we use MessageLabs to filter inbound mail: I am sure you will appreciate the pleasure that can be had from blocking access to tcp/25 on your firewall) so I don't need something that's high performance. Spam and anti-virus are also not too important, again thanks to MessageLabs. What I really want is a simple, terse configuration syntax that doesn't require arcane knowledge to read and write. Something that can accept mail for n domain names, and deliver to our IMAP server according to a simple mapping.

Any suggestions?