Subject: separate imapdnossl and imapd

From: [email-masked] (Alexy Khrabrov)
Date: Wed, 14 Aug 2002 19:05:48 -0400

And finally, in order to make PHP 4.3.0-dev
imap_open() work with port="143", I had to build a
separate imapd without SSL (SSLTYPE=none).

Otherwise, it refused to work until I removed the
SSL certificate.  In fact, the certificate's name
prefix should match the executable's name, so I
could just use a symlink to an imapd _with_ SSL
but under _another_ name!  The only crucial detail
is, the "imapdnossl" link should point to an imap
which _does allow_ plain text password.  Since I
built imapd-slx-nopwd for my imaps, I need another
executable for imapdnossl.  For instance, I could
use either imapd-slx-nossl _or_ imapd-slx-unix
(names reflect options of platform-SSLTYPE to
c-client's make) as the target for my imapdnossl
link, as long as I _don't_ have
/usr/local/ssl/certs/imapdnossl.pem!

And finally, you can run DJB's tcpserver without
any path fixes, _given_ you cd to the imapd's
executable directory and start it from there,
e.g.

cd /usr/local/sbin
tcpserver 0 993 imapd &
tcpserver 127.0.0.1 143 imapdnossl &

(My imapd is a symlink to imapd-slx-nopwd).

Now everybody can connect to the secure process,
and only local users can connect to the insecure
one.  E.g., PHP is a bit faster on the plain imap.

Well, I just did this investigation for fun, as I
heed the recommendation to use ssh tunnel with
fetchmail or others and invoke imapd directly in a
plugin instead of SSL.  But I learned a lot about
SSL/TLS on the way!

Cheers,
Alexy
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------