I run Courier IMAP with STARTTLS support. Currently,
IMAP_TLS_REQUIRED is set to 0 (false), meaning that a client is fully permitted to use a clear-text login on an unsecured channel. Setting it to 1 (true) is not an option, as it breaks SquirrelMail (which can't use STARTTLS); however, I know for a fact that only certain IP addresses are legitimately going to be using unencrypted transport.
In the simplest case, it should theoretically be possible to permit connections from 127.0.0.1 without encryption, while demanding STARTTLS before auth on all other connections. However, I've been unable to do this. Also, what if I want something more complicated - maybe there's a web server on 203.0.113.147 talking to an IMAP server on 203.0.113.148, with a secure LAN in between. (Ignore for now the challenge of proving that the LAN truly is secure.) Is there a way to set
IMAP_TLS_REQUIRED differently for different connections?