Subject: Force ipop3d to use TLS/SSL when running on odd port

From: "Ian Hunter" <[email-masked]>
Date: Fri, 9 Jul 2004 09:46:15 -0400

I'm trying to allow pop3s access to folks behind restrictive corporate
firewalls, that block port 995.  It seems that no matter what port I tell
xinetd to run ipop3d on in /etc/services, it falls back to no SSL, if it's
not called "pop3s," even if I put "/ssl /tls" in as arguments.  That is to
say, I can get it to run on any port I want, but it will only do SSL if the
service name is pop3s.

Does ipop3d check it's name use SSL if it's pop3s and no SSL otherwise?
What am I missing?

Help!

Ian

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Fri, 9 Jul 2004 07:08:20 -0700 (PDT)

> Does ipop3d check it's name use SSL if it's pop3s and no SSL otherwise?

Correct.  ipop3d starts in SSL only when on the pop3s port.

Servers can not use command line arguments, since server argv is used by 
various accounting packages.  Something like "/ssl /tls" in a command line 
argument wouldn't exist on UNIX anyway (on UNIX, switches start with "-").

You seem to be confused about TLS.  TLS is started by a client command, 
and not by the selection of port.  Thus for TLS, it can be on any port 
since the connection is supposed to start in plaintext.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: Erik Kangas <[email-masked]>
Date: Fri, 09 Jul 2004 10:26:26 -0400

I think the issue is that Ian wants to enforce an encrypted POP session on 
a non-pop3s port.  TLS doesn't enforce, it just provides the option (unless 
there is a way to require TLS).

I think, that short of modifying the source for ipop3d, you could 
accomplish this task my using "stunnel" on the server to listen to the 
desired port for SSL connections and "forward" these to the pop3s port 
locally.  This will ensure that you can have an SSL-only POP connection on 
an alternate port and will solve the ipop3d port issue.  See "stunnel.org".

-Erik Kangas

Mark Crispin wrote:

> various accounting packages.  Something like "/ssl /tls" in a command 
> line argument wouldn't exist on UNIX anyway (on UNIX, switches start 
> with "-").
> 

-- 

Erik Kangas, Ph.D. --- President of Lux Scientiae, Incorporated
[email-masked]  ---  http://luxsci.com

---

From: Brad Arlt <[email-masked]>
Date: Fri, 9 Jul 2004 10:02:19 -0600

On Fri, Jul 09, 2004 at 10:26:26AM -0400, Erik Kangas wrote:
> accomplish this task my using "stunnel" on the server to listen to
> the desired port for SSL connections and "forward" these to the
> pop3s port locally.  This will ensure that you can have an SSL-only
> POP connection on an alternate port and will solve the ipop3d port
> issue.  See "stunnel.org".

This seems rather extreme given the source code changes are changing
"995" to another number (src/c-client/pop3.c line 35 of imap-2004
release).  And it appears that you might be able to get away with
simply changing the pop3s line in /etc/services.

Neither is it overly complicated.  Certainly less hassle than stunnel
was (I have used it for imap over SSL before uw-imap supported SSL -
builtin support is *so* much better).
-----------------------------------------------------------------------
   __o		Bradley Arlt			Security Team Lead
 _ \<_		[email-masked]		University Of Calgary
(_)/(_) 	Las hojas de coca no son droga 	Computer Science

---

From: "Ian Hunter" <[email-masked]>
Date: Fri, 9 Jul 2004 12:23:34 -0400

But you can't have ipop3d handling pop3s on *two different ports* at the
same time; either 995 is SSL, -or- another port is SSL.  I'm in the middle
of changing my pop3 config to use stunnel, that was the only way I can see
to get this working short term.

ipop3d ought to have a "force SSL" switch to support the xinetd crowd.  :(

---

From: Mark Crispin <[email-masked]>
Date: Fri, 9 Jul 2004 10:45:08 -0700 (PDT)

On Fri, 9 Jul 2004, Erik Kangas wrote:
> TLS doesn't enforce, it just provides the option (unless 

In the normal build, plaintext passwords are not allowed (the USER command 
is not permitted) until either SSL is in effect or TLS is negotiated.

So, in effect, TLS is required unless you have Kerberos or CRAM-MD5 set 
up.

-- Mark --