Subject: ports 143 and 993 should have the same imapd setup?!

From: [email-masked] (Alexy Khrabrov)
Date: Wed, 14 Aug 2002 16:53:24 -0400

Quoting Steve Barber,
On Wed, Aug 14, 2002 at 03:12:24PM -0400, [email-masked] wrote:
> 
> OK, here's what's going on: whenever I specified
> imaps, or port 993, clients tried to establish
> immediate SSL connection to it and failed.  When I
> instructed mutt to keep the mailbox at the regular
> insecure imap://localhost/INBOX, and 
> set ssl_starttls=ask-yes, it detects that imapd
> advertises TLS and asks whether I want it.
> 
> Do people run imaps on port 993 with UW imapd and
> able to get TLS connection somehow?  Looks like
> clients believe they're in a tunnel right away,
> seems that's whence those weird protocol errors
> from fetchmail (which doen't seem to do --sslproto
> tls1 as it reports SSL3 error anyways)...

Yes, port 993 is just IMAP tunnelled through SSL.
That's what you should be seeing.  I'm not sure why
you're seeing any plain text on there at all.

To test, you can use something like

openssl s_client -connect mailhub:993

It should show you the certificates and then show you the
IMAP connect banner.  You shouldn't see much of anything
using plain telnet to port 993.

Steve
--

Well, UW c-client docs/SSLBUILD explicitly says to
install one and the same imapd, without any
tunneling, on port 993 as on 143.  This is
misleading and should be corrected.  Because what
happens is, you get the same plain text imap start
there.  The new Pine 4.44, which I just built,
understands a mailbox specification /tls such as

inbox-path={localhost:993/tls/novalidate-cert}INBOX

and as it's TLS, it starts in text mode and
switches to TLS at once.  There's no difference in
this behavior of Pine on port 993 with Mutt on
port 143 with the latter's ssl_use_tlsv1 only set
and ssl_use_sslv2/3 unset.  However, Mutt doesn't
expect such a thing as a TLS imapd waiting in 993
and tries tunneling right away, as does Netscape
and other clients, notably fetchmail --ssl
--sslproto tls1.

So either everybody ain't getting it and must
catch up with Pine, making ports 143 and 993
essentially the same for TLS, or c-client
docs/SSLBUILD must not instruct to install imapd
in exactly the same way on both ports.

What is the imap protocol wisemen opinion?  Mark?

Cheers,
Alexy

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Tue, 20 Aug 2002 15:57:27 -0700 (Pacific Daylight Time)

On Wed, 14 Aug 2002, Alexy Khrabrov wrote:
> tunneling, on port 993 as on 143.

This is correct.  imapd is supposed to detect that it is running on port
993 and automatically start in SSL mode.

> Because what
> there.

If that happens, something is wrong either with your build or your
installation.  Have you verified that you followed *ALL* the instructions
in the BUILD and SSLBUILD files?