Subject: [Imap-uw] Hard coded port questions

From: Matt Linton <[email-masked]>
Date: Thu, 16 Jun 2005 10:46:50 -0700

Greetings!

I'm attempting to do some strange things for stranger reasons, so of 
course the problems I'm running into are my fault.

That said...

I'm trying to run an IMAPD with SSL on two ports on a system. One on 
port 993 and one on port 994. This I've done by compiling a regular 
imapd (gcc Solaris) as /usr/sbin/imapd, and a second copy of the binary 
with changed port definitions as /usr/sbin/imapd2

However, the imapd software doesn't seem to recognize that a system 
connecting to it on port 994 is trying to talk SSL with it.

I looked through the source and found the c-client code hard coding port 
993 to the SSL port, so I thought perhaps imap4v1 compiles the c-client 
definitions in somehow, and changed them in c-client, then recompiled.  
No dice, though. When I connect on port 994 with a client attempting to 
talk SSL, I get a nice long hang.

Does anyone have any quick clarifications for me as to how the 
IMAPSSLPORT definition in imap4r1.c ends up in the 'imapd' binary? If at 
all?

More importantly, am I going about this the right way at all?
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Mark Crispin <[email-masked]>
Date: Thu, 16 Jun 2005 11:05:28 -0700 (PDT)

The SSL server port used by the IMAP server is the port identified as 
"imaps" (/etc/services in most systems, maybe elsewhere if your system 
uses something like NetInfo or Yellow Pages).

This is set in the third argument in the server_init() call early in the 
imapd.c source.

In order to have a special version of imapd listening on another port, you 
must define the new port name in /etc/services (or whereever), and then 
modify imapd so that the third argument of the server_init() call uses 
that port name instead of imaps.

Note, by the way, that port 994 is the IRC SSL port (ircs).  You can't 
arbitrarily choose port numbers.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Matt Linton <[email-masked]>
Date: Thu, 16 Jun 2005 11:11:43 -0700

Mark:  Thanks for the tip, and for the warning RE: irc-ssl.

Of course I understand the danger in messing with port numbers that are 
already defined in RFCs.  In the case I'm working with, the network this 
server is on will never be running IRC, and if it is, there are major 
problems needing to be looked into! 

For the curious, explanations are below as to the problem I'm trying to 
solve....

A single UNIX server in this case must serve mail for two networks which 
are isolated from each other, off a single filesystem.

So one of the things I've been doing is routing traffic from one network 
to the other for IMAP.  This worked beautifully when we were not SSL 
encrypting things, but when SSL is thrown into the mix, certificate 
signing becomes an issue.

One imap daemon can only have one signed certificate (to my knowlege). 
However, due to creative routing and things, the requests to 
<server1.test.net> are coming FROM <server2.test.net> as well as from 
server1.

So, I am running two daemons on different ports to deal with the 
certificate problem:  Requests to port 993 must be presented with a 
signed certificate for server1.test.net, but requests to port 994 must 
be presented with a signed cert for server2.test.net.

Mark Crispin wrote:

> This is set in the third argument in the server_init() call early in 
> the imapd.c source.
>
> In order to have a special version of imapd listening on another port, 
> you must define the new port name in /etc/services (or whereever), and 
> then modify imapd so that the third argument of the server_init() call 
> uses that port name instead of imaps.
>

---

From: Mark Crispin <[email-masked]>
Date: Thu, 16 Jun 2005 11:21:25 -0700 (PDT)

> <server1.test.net> are coming FROM <server2.test.net> as well as from 

Another way to solve the problem is to have a *.test.net certificate. 
Wildcard certificates are not deployed lightly, but at times they have 
their uses.

-- Mark --

---

From: [email-masked]
Date: Fri, 17 Jun 2005 10:43:17 +0200 (MEST)

Still another way to solve the problem is, do not use a second imap
daemon. Generate your server certificate with CN=<hostname of server> and
alternative names of
DNS:<hostname of server>,DNS:server1.test.net,DNS:server2.test.net
and all alias names that may be used by clients to connect to the server.
openssl x509 allows you to do that.
We found it essential to repeat CN in the alternative names list.
All modern mailtools accept a cerificate if CN or one of the alternative
names matches. One notable exception is pine (or better the c-client
library at the pine61 level). It only tests CN and complains if it does
not match or you have used the novalidate-cert switch. Maybe Mark could
extend the code to accept the alternative names.

Kind regards
Paul

> Si vis pacem, para bellum.

========================================================================
Paul Tedaldi                     |
Informatikdienste                |    Email:  [email-masked]
Universitaet Zuerich             |
Winterthurerstr. 190             |    Tel:    +41 (0)44 635 4523
CH-8057 Zuerich                  |    Fax:    +41 (0)44 635 4505
Switzerland                      |
========================================================================
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Matt Linton <[email-masked]>
Date: Fri, 17 Jun 2005 09:41:13 -0700

Paul: That's an excellent suggestion. I will give it a try to see if it 
works.  We're supporting just about every mail client under the sun 
(emacs & rmail included), but if it works, it works.

---

From: Mark Crispin <[email-masked]>
Date: Wed, 3 Aug 2005 17:14:33 -0700 (Pacific Daylight Time)

Paul -

I am back from vacation and am looking into implementing this.

Can you identify an IMAP server system on the Internet that currently has 
such a server certificate?  I don't need an account on it, I just need to 
be able to access it.

Also, please verify my belief that PC Pine already has this capability and 
it is only UNIX Pine that has this limitation.

-- Mark --