0

We have here an old helpdesk software that only speaks imaps using the now obsolete SSLv3. Obviously, such protocol is no longer accepted by Outlook 365.

I proposed to install a TLS tunnel/applicational proxy using Debian Stretch as a broker to be able to speak with Outlook 365, so the application will talk IMAP to one end of the tunnel, and the other end will talk with a more modern encryption to Outlook 365.

I installed the required package with:

sudo apt-get install stunnel4

And enabled TLS editing /etc/default/stunnel4

ENABLED=1

What do I need to do more?

3

I created a /etc/stunnel/stunnel.conf file based on the example file for a gmail tunnel (gmail-imap rule at /usr/share/doc/stunnel4/examples/stunnel.conf-sample):

[outlook365-imap]
client = yes
accept = 1.1.1.1:143
connect = outlook.office365.com:993
verifyChain = no

whereas 1.1.1.1 is the IP address of the interface of the tunnel server.

Then I started stunnel with:

sudo service stunnel4 start

To check the tunnel is working, telnet to it:

$telnet 1.1.1.1 143
Trying 1.1.1.1...
Connected to 1.1.1.1.
Escape character is '^]'.
* OK The Microsoft Exchange IMAP4 service is ready. [VgBJADEAUABSADAANwBDAEEAMAAxADcAMQAuAGUAdQByAHAAcgBkADAANwAuAHAAcgBvAGQALgBvAHUAdABsAG8AbwBrAC4AYwBvAG0A]
A1 LOGOUT
* BYE Microsoft Exchange Server 2016 IMAP4 server signing off.
A1 OK LOGOUT completed.
Connection closed by foreign host.

With this output we confirm the TLS tunnel is indeed working properly.

We also tested it with an Outlook Windows client pointed to 1.1.1.1:143 before pointing the application to the tunnel. It works well.

Adenda for begginers: why this works? Because most of the "new" secure Internet protocols are built using the old plaintext protocols with an added layer of encryption.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.