Subject: Using imapd on ports 143 & 993 (SSL) simultaneously?

From: Chris Bunch <[email-masked]>
Date: Mon, 25 Aug 2003 19:48:20 +0100

Is it possible to compile imapd so that it will accept unencrypted logins
and sessions on port 143 and also encrypted sessions via SSL on port 993,
and if so how?

This may seem a crazy idea (and maybe it is) but what I am about to do is
upgrade my server from an earlier, non-SSL version of imapd. I have users
who connect using standard email clients (eg Entourage) who I would like to
move to SSL. I also have a PHP-based webmail client (SquirrelMail) running
with Apache on the same server as imapd.

Unfortunately,  SquirrelMail (SM)  doesn't do SSL, though I could set up an
stunnel from port 143 to 993 (with additional overheads). However, since SM
and imapd are on the same machine, I could block all incoming traffic on
port 143, so that the only 'client' that would open sessions with impad on
port 143 would be SM locally, and the only option for external (non-web)
clients would be SSL via 993.

I have tried building with  "SSLTYPE=unix" in the make command line but that
doesn't achieve the above.

Chris

Dr Christopher Bunch
Bayswater Farm House
Headington
Oxford OX3 8BY
_____________________

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Jim Riggs <[email-masked]>
Date: Mon, 25 Aug 2003 14:08:02 -0500

> and sessions on port 143 and also encrypted sessions via SSL on port 

Look through docs/SSLBUILD in the source distribution.  It describes 
the process in detail.  Make sure you set up your inetd/xinetd config 
properly (assuming a Unix-type system).

---

From: "Jeff Breitner" <[email-masked]>
Date: Mon, 25 Aug 2003 15:15:10 -0400

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Chris Bunch
> Sent: Monday, August 25, 2003 2:48 PM
> To: [email-masked]
> Subject: Using imapd on ports 143 & 993 (SSL) simultaneously?
> 
> 
> Is it possible to compile imapd so that it will accept 
> unencrypted logins and sessions on port 143 and also 
> encrypted sessions via SSL on port 993, and if so how?
> 
> This may seem a crazy idea (and maybe it is) but what I am 
> about to do is upgrade my server from an earlier, non-SSL 
> version of imapd. I have users who connect using standard 
> email clients (eg Entourage) who I would like to move to SSL. 
> I also have a PHP-based webmail client (SquirrelMail) running 

It's not a crazy idea, I do the same thing since I didn't want any
potential overhead nor problems for non-SSL IMAP users.

However, I did it with two different executables and then just pointed
inetd to the respective imapd per port number.  Works great, lasts a
long time.

Keep in mind imapd doesn't listen on any ports itself; it's handed the
session by inetd, or xinetd if that's your game.

---

From: Mark Crispin <[email-masked]>
Date: Mon, 25 Aug 2003 12:25:09 -0700 (PDT)

> and sessions on port 143 and also encrypted sessions via SSL on port 993,

All recent versions of UW imapd recognize that it has been invoked on port
143 vs. port 993, and automatically puts itself into the correct mode, as
long as it was built with SSL support (that is, not using SSLTYPE=none).

If you build with SSLTYPE=unix, then unencrypted logins are permitted on
port 143 (that is, you can use the LOGIN, AUTHENTICATE PLAIN, and
AUTHENTICATE LOGIN commands).

If you build with SSLTYPE=nopwd (or SSLTYPE=unix.nopwd), then unencrypted
logins are not permitted on port 143 unless you first negotiate TLS
encryption (STARTTLS command).  You can use encrypted logins (AUTHENTICATE
GSSAPI, AUTHENTICATE CRAM-MD5, etc.) if your server is configured to
support that.

> doesn't achieve the above.

Can you be more specific about your expectations vs. results?  It should
work.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.