Subject: forcing SSL/TLS only on imap

From: Marc MERLIN <[email-masked]>
Date: Mon, 5 Nov 2001 15:46:33 -0800

I want to require encrypted connections for my users.

So far I've simply not allowed connections to 143, and only opened up 993.

However, with TLS, new clients may drop SSL and connect to 143 and do TLS,
which won't work in my case.

Is there a setting or a patch for imapd to accept SSL connections on 993, or
accept connections on 143 provided that the client switches to TLS?
(of course, even in this case, there is probably not much I can do about
clients that send me a
1 login user pwd
as soon as they see the imapd banner: I can drop the connection, but the
password will have already been sent by then...

Thanks,
Marc
-- 
Microsoft is to operating systems & security ....
                                      .... what McDonalds is to gourmet cooking
  
Home page: http://marc.merlins.org/   |   Finger [email-masked] for PGP key
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Mon, 5 Nov 2001 16:50:15 -0800 (PST)

> accept connections on 143 provided that the client switches to TLS?

Perhaps what you want is to build the IMAP toolkit with SSLTYPE=nopwd instead
of SSLTYPE=unix

This is an important new capability of imap-2001; it isn't in imap-2000.