Subject: [Imap-uw] Selectively forcing SSL access for IMAP and POP

From: Erik Kangas <[email-masked]>
Date: Thu, 28 Jul 2005 15:25:30 -0400

Hello,

I have some server configured soas to allow both insecure POP/IMAP and 
POP/IMAP over SSL.  We are using UW IMAP and PAM for authentication.

What I would like to do is force *selected* users to only be allowed to login 
via the SSL ports.  I know I can do this by putting these people on a 
different server and either blocking the insecure ports or compiling imap/pop 
to only allow SSL; however, this is not an option.... they have to stay on 
the same server as other users who do want to use insecure logins.

So,

* Is there some way to use different PAM files for SSL and non-SSL 
connections?  If so, we could use PAM-Listfile to allow or deny access on a 
per-user basis.

* Are there other suggestions that are clean?

I suppose a "dirty" solution would be to hack the authentication part of 
imapd to do a pam-listfile similar thing ... knowing if the login is using 
SSL or not.  However, I prefer to keep my IMAPd code as close as possible to 
the source distribution.

Any suggestions are very welcome.

Thank you,

-Erik Kangas

-- 

Erik Kangas, Ph.D. --- President of Lux Scientiae, Incorporated
[email-masked]  --- http://luxsci.com

Office Phone:        1-617-507-2162
Cell Phone:          1-617-596-9558        P.O. Box 326
Luxsci Toll Free:    1-800-441-6612        Westwood, Massachusetts
LuxSci FAX:          1-413-332-0598        02090, USA
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Matt Selsky <[email-masked]>
Date: Thu, 28 Jul 2005 17:08:39 -0400

We patched imapd and pop3d to use a slightly different different PAM 
service name if using an insecure login.  Then we had PAM check a group 
to see if that user was still permitted to use insecure services.  When 
we finally had all users doing secure logins we removed the patch.  
This patch changes the PAM service name and syslogs the insecure logins 
for POP3.  You can do something very similar for IMAP, but I don't have 
that patch handy.

-- 
Matt

> What I would like to do is force *selected* users to only be allowed 
> to login via the SSL ports.  I know I can do this by putting these 
> people on a different server and either blocking the insecure ports or 
> compiling imap/pop to only allow SSL; however, this is not an 
> option.... they have to stay on the same server as other users who do 
> want to use insecure logins.
>
> So,
>
> connections?  If so, we could use PAM-Listfile to allow or deny access 
> on a per-user basis.
>
> I suppose a "dirty" solution would be to hack the authentication part 
> of imapd to do a pam-listfile similar thing ... knowing if the login 
> is using SSL or not.  However, I prefer to keep my IMAPd code as close 
> as possible to the source distribution.
>

---

From: Erik Kangas <[email-masked]>
Date: Thu, 28 Jul 2005 19:09:47 -0400

Matt Selsky wrote:

> service name if using an insecure login.  Then we had PAM check a 
> group to see if that user was still permitted to use insecure 
> services.  When we finally had all users doing secure logins we 
> removed the patch.  This patch changes the PAM service name and 
> syslogs the insecure logins for POP3.  You can do something very 
> similar for IMAP, but I don't have that patch handy.
>
>
Thnak you Matt,

Does anyone have an example of a similar PAM patch or could point to the 
righ parts of the code that need to be modified, etc?  This would 
certainly make our implementation easier.

Best,

-Erik Kangas

---

From: Matt Selsky <[email-masked]>
Date: Fri, 29 Jul 2005 01:44:12 -0400

No problem.  This patch does the same thing for IMAP.  I haven't tested 
the PAM part, but it should be OK.

-- 
Matt

> Does anyone have an example of a similar PAM patch or could point to 
> the righ parts of the code that need to be modified, etc?  This would