Subject: Re: UW IMAP toolkit 2000 (imap-2000) BETA released

From: Mark Crispin <[email-masked]>
Date: Wed, 31 May 2000 10:29:38 -0700 (PDT)

On Wed, 31 May 2000, Greg Hidley wrote:
> We are currently using UW Imap 4.6 server on a Solaris Sparc system and
> have it wrapped with stunnel to use SSLea SSL security.
>
> Are there specific advantages to using the "built-in" support of imap-2000
> on the server?

Yes there are.  The most important one is that you only need one process
per IMAP session instead of two.  You will get a performance boost by not
having all the I/O going through stunnel separately.

Another important benefit is that it gives TLS support as well.  This is
the new politically correct form of SSL and clients will start using it.

A secondary one is that the IMAP server will once again know the actual
host addresses of the IMAP session.  This will make the log messages more
useful, and more importantly let make Kerberos work under SSL if you use
Kerberos.

-- Mark --

* RCW 19.190 notice: This email address is located in Washington State.	*
* Unsolicited commercial email may be billed $500 per message.		*
Science does not emerge from voting, party politics, or public debate.

---

From: Cliff Green <[email-masked]>
Date: Thu, 1 Jun 2000 16:32:21 -0400 (EDT)

On Wed, 31 May 2000, Mark Crispin wrote:

MC> On Wed, 31 May 2000, Greg Hidley wrote:
MC> > We are currently using UW Imap 4.6 server on a Solaris Sparc system and
MC> > have it wrapped with stunnel to use SSLea SSL security.
MC> >
MC> > Are there specific advantages to using the "built-in" support of
MC> imap-2000 > on the server?

[munch]

MC> Another important benefit is that it gives TLS support as well.  This is
MC> the new politically correct form of SSL and clients will start using it.

So does this mean imaps and pop3s do or don't need to be added to
/etc/inetd.conf and /etc/services?  My naive reading of rfc2595 (section
7, imaps and pop3s ports) raises the question.  Previously, I used stunnel
and port 993;  currently, I've just changed those entries to point at the
imap-2000 versions of imapd and ipop3d - is this incorrect?

Also, is there any method you would recommend of checking or logging
(other than "imaps alternative service init" in mail.log) to indicate that
some actual encryption may be going on here?

c
-- 
Clifford Green               Internet -  [email-masked]
Academic Computing Services     voice -     732-235-5250
UMDNJ-IST                         fax -     732-235-5252
Keep interested in your own career, however humble; it is a real possession in the changing fortunes of time.

---

From: Mark Crispin <[email-masked]>
Date: Thu, 1 Jun 2000 13:44:52 -0700 (PDT)

On Thu, 1 Jun 2000 16:32:21 -0400 (EDT), Cliff Green wrote:
> /etc/inetd.conf and /etc/services?

Yes, add entries for imaps and pop3s.

> Previously, I used stunnel

Yes, that is correct.  Port 993 for imaps, port 995 for pop3s.

> some actual encryption may be going on here?

You can try using the "openssl" test application of OpenSSL, doing something
like:

% openssl
OpenSSL> s_client -host imap.myserver.com -port 993