3

I run Courier IMAP with STARTTLS support. Currently, IMAP_TLS_REQUIRED is set to 0 (false), meaning that a client is fully permitted to use a clear-text login on an unsecured channel. Setting it to 1 (true) is not an option, as it breaks SquirrelMail (which can't use STARTTLS); however, I know for a fact that only certain IP addresses are legitimately going to be using unencrypted transport.

In the simplest case, it should theoretically be possible to permit connections from 127.0.0.1 without encryption, while demanding STARTTLS before auth on all other connections. However, I've been unable to do this. Also, what if I want something more complicated - maybe there's a web server on 203.0.113.147 talking to an IMAP server on 203.0.113.148, with a secure LAN in between. (Ignore for now the challenge of proving that the LAN truly is secure.) Is there a way to set IMAP_TLS_REQUIRED differently for different connections?

Improve this question

1 Answer 1

Reset to default
1

I don't think there would be a way to set IMAP_TLS_REQUIRED to true and use clients that don't support STARTTLS.

However, you have other possibilities if you full control of the network. For the SquirrelMail connections, you could use one firewall rule per IP address so at least only those people can connect to that service without TLS. It won't really make it any safer if MiTM is still a possibility on the network.

However, that doesn't force the other users (say, Thunderbird users) to use encryption. So it's not as safe as could be.

The one other way is to run two instances of courier on two different ports. You could choose a different port for the non-secure (it won't really hide it from hackers who can always check all your open ports). That way the one version with encryption can use the IMAP_TLS_REQUIRED flag and at least those users will never end up not using encryption.

All of that said, it looks like TLS v1.2 is not working (at least on Ubuntu 18.04) so courier may have to be changed to something else...

Improve this answer
2
  • 1
    Picking a different port for the non-secure one will work if coupled with a firewall rule that ensures that the non-secure port is accessible only from the appropriate IP addresses. That looks like the best option; it's extra hassle to run two nearly-identical Couriers, but if that's all Courier can do, so be it.
    – rosuav
    Commented Nov 8, 2020 at 12:58
  • @rosuav Yeah, running two instances of the same service on a single computer is often a complicated matter. One instance with the firewall may be enough if the IPs that want the non-encrypted access do not need to also access the encrypted version (since courier can open both ports).
    – Alexis Wilke
    Commented Nov 8, 2020 at 16:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .