Topic: secure IMAP in 6.0b3?

[John Lewis]

In poking around, I'm seeing imap ssl stuff on my recently upgraded 6.0b3 server, but am not able to connect my outlook client to the server using the ssl imap port of 993.

Anyone have an idea of how to access and use the secure imap settings?

Can I turn of regular IMAP and POP3 access, and only allow secure access?

Damien Curtain's contrib's were great for doing this on 5.6.  Is there any similar functionality with 6.0b3?

Thanks.

[vj]

no, not that I know of, have been searching a lot for this.
plz let me know if you come across it

best regards
vj

[John Lewis]

in looking at /home/e-smith/configuration, i see:

ssmtpfront-qmail=service|access|public|status|disabled
imaps=service|access|public|status|disabled
popds=service|access|public|status|disabled

Is this what I think it is?

No service panels to do this?  Any documentation?

Sigh...

[John Lewis]

OK, I'm guessing these entries were leftover from my 5.6 install with Damien Curtain's securemail rpm's.

in checking out http://dovecot.procontrol.fi/documentation.html it appears dovecot can do ssl/tls by default.  Below is the SSL portion of the example config, with the default parameters shown as examples:

# Protocols we want to be serving:
#  imap imaps pop3 pop3s
#protocols = imap imaps

# IP or host address where to listen in for connections. It's not currently
# possible to specify multiple addresses. "*" listens in all IPv4 interfaces.
# "[::]" listens in all IPv6 interfaces, but may also listen in all IPv4
# interfaces depending on the operating system. You can specify ports with
# "host:port".
#listen = *

# IP or host address where to listen in for SSL connections. Defaults
# to above if not specified.
#ssl_listen =

# Disable SSL/TLS support.
#ssl_disable = no

# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
# dropping root privileges, so keep the key file unreadable by anyone but
# root. Included doc/mkcert.sh can be used to easily generate self-signed
# certificate, just make sure to update the domains in dovecot-openssl.cnf
#ssl_cert_file = /etc/ssl/certs/dovecot.pem
#ssl_key_file = /etc/ssl/private/dovecot.pem

# SSL parameter file. Master process generates this file for login processes.
# It contains Diffie Hellman and RSA parameters.
#ssl_parameters_file = /var/run/dovecot/ssl-parameters.dat

# How often to regenerate the SSL parameters file. Generation is quite CPU
# intensive operation. The value is in hours, 0 disables regeneration
# entirely.
#ssl_parameters_regenerate = 24

Anyone have a clue as to how to turn all of this on?  Does this mean generating cert's, and opening up holes in iptables to allow ssl/tls connections?

help!

[John Lewis]

No responses?  Surely this is a key feature for people using 6.0b3?  I am really wishing now I had not upgraded, as this is a key feature for me .
In the interim, I am using ssh tunnels to access my mail securely remotely, but this is a pain, and not something I want regular users to have to do.

Can ANYONE at least point me in the right direction regarding SSL/TLS features for POP/IMAP?  I'd be a willing beta tester

[Charlie Brady]

John Lewis wrote:

> Can ANYONE at least point me in the right direction regarding
> SSL/TLS features for POP/IMAP?

TLS for IMAP is a (new) standard feature. You don't need to do anything but use it.

IMAPS (IMAP over SSL without TLS) requires a contrib add-on, just as it did with earlier versions.

Charlie

[John Lewis]

Right, and the existing contrib addons are not configured to use dovecot imap...  I sent a note to Damien at pagefault.org asking if he planned to address this new version, but haven't heard back.

Sadly, I'm using microsloth Lookout, which does not support TLS...

[Martin Trigg]

Is any one able to offer some further pointers or suggested reading material as to how to get TLS for IMAP operating?

Which mail clients should work? Searching on the web seems to indicate Outlook and Outlook Express support TLS but no joy, Eudora which specifically lists StartTLS fails with the following error message when configured to use it:

Connecting to the Mail Server...., EHLO account.domain.com.au [12:53:16PM] Server does not support SSL

Searching through my SME V6 box I could only find a single Template fragment that related to dovecot.conf, so I am unsure what configuration parameters are set.

Reading info on the Dovecot site (http://dovecot.procontrol.fi) it appears Secure POP3 may be possible but not sure if this is the case with how SME has it implemented.

Any feedback greatly appreciated.

Martin

[Harold]

Martin Trigg wrote:
 
> Is any one able to offer some further pointers or suggested
> reading material as to how to get TLS for IMAP operating?

If your mail client uses it, it just works. There's nothing to configure (execpt maybe in your mail client).

> Connecting to the Mail Server...., EHLO account.domain.com.au
> [12:53:16PM] Server does not support SSL

That's SMTP, not IMAP. There's no TLS support for SMTP.

Harold

[Charlie Brady]

Martin Trigg wrote:

> Searching through my SME V6 box I could only find a single
> Template fragment that related to dovecot.conf, so I am
> unsure what configuration parameters are set.

SME doesn't use dovecot.conf, and doesn't use all of dovecot, only the IMAP daemon itself, which is executed via /var/service/imap/run.

Charlie