8:28 p.m.
This is probably an upstream problem, but I'm just putting my feelers
out to see if I'm missing something, or thunderbird is missing something
I consider absolutely essential. And that's what my subject states.
Thunderbird (and Mozilla-Mail, for that matter) doesn't seem to support
STARTTLS for IMAP. No, I'm not talking about IMAPS (port 993), but
honest to goodness STARTTLS over port 143 like it should.
So is it me, or is thunderbird really lacking in this area?
--
-Paul Iadonisi
Senior System Administrator
Red Hat Certified Engineer / Local Linux Lobbyist
Ever see a penguin fly? -- Try Linux.
GPL all the way: Sell services, don't lease secrets
8:47 p.m.
Am Mo, den 11.10.2004 schrieb Paul Iadonisi um 3:28:
Thunderbird (and Mozilla-Mail, for that matter) doesn't seem to
support
STARTTLS for IMAP. No, I'm not talking about IMAPS (port 993), but
honest to goodness STARTTLS over port 143 like it should.
So is it me, or is thunderbird really lacking in this area?
-Paul Iadonisi
Which IMAP server offers IMAP/TLS on port 143?
Alexander
--
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 2 (Tettnang) kernel 2.6.8-1.521smp
Serendipity 03:46:42 up 11 days, 6:12, load average: 0.82, 0.56, 0.46
9:05 p.m.
On Sun, 2004-10-10 at 21:47, Alexander Dalloz wrote:
[snip]
Which IMAP server offers IMAP/TLS on port 143?
Well, specifically I'm talking about STARTTLS, not just plain old
TLS. I'm using Cyrus-Imapd, but I'm sure it's not the only IMAP server
that supports it. If you look in the account setup for evolution IMAP
accounts, you see the option "Whenever Possible" as one of the choices
for 'Use secure connection (SSL):'. That uses port 143, but negotiates
the TLS connection with STARTTLS.
--
-Paul Iadonisi
Senior System Administrator
Red Hat Certified Engineer / Local Linux Lobbyist
Ever see a penguin fly? -- Try Linux.
GPL all the way: Sell services, don't lease secrets
9:53 p.m.
Alexander Dalloz writes:
Am Mo, den 11.10.2004 schrieb Paul Iadonisi um 3:28:
> Thunderbird (and Mozilla-Mail, for that matter) doesn't seem to support
> STARTTLS for IMAP. No, I'm not talking about IMAPS (port 993), but
> honest to goodness STARTTLS over port 143 like it should.
> So is it me, or is thunderbird really lacking in this area?
> -Paul Iadonisi
Which IMAP server offers IMAP/TLS on port 143?
Pretty much all of them.
10:17 p.m.
Am Mo, den 11.10.2004 schrieb Sam Varshavchik um 4:53:
> Which IMAP server offers IMAP/TLS on port 143?
Pretty much all of them.
Ok, I always configures IMAPs with usage of port 993, simply because
otherwise you can't force the users to use the secured connection. If
you enable port 143 users tend to simply use IMAP - and then auth data
goes over the line unencrypted, especially by those Outlook users using
LOGIN.
Alexander
--
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 2 (Tettnang) kernel 2.6.8-1.521smp
Serendipity 05:12:41 up 11 days, 7:38, load average: 1.36, 1.58, 1.37
10:24 p.m.
On Sun, 2004-10-10 at 23:17, Alexander Dalloz wrote:
Am Mo, den 11.10.2004 schrieb Sam Varshavchik um 4:53:
> > Which IMAP server offers IMAP/TLS on port 143?
>
> Pretty much all of them.
Ok, I always configures IMAPs with usage of port 993, simply because
otherwise you can't force the users to use the secured connection. If
you enable port 143 users tend to simply use IMAP - and then auth data
goes over the line unencrypted, especially by those Outlook users using
LOGIN.
Not true...just set allowplaintext to 'no' in your /etc/imapd.conf
(for Cyrus). If you're imap server uses SASL for network
authentication, it should the same setting, but possibly a different
filename path for imap servers other than cyrus. When you set this
option, the LOGINDISABLED capability will show up in the IMAP CAPABILITY
command, which does what the name implies. After STARTTLS is
negotiated, another CAPABILITY command will show that LOGINDISABLED is
no longer there, allowing login to proceed.
As an FYI, even if you're not using cyrus-imapd, the cyrus-imapd-utils
package can come in very handy...especially imtest and smtptest (really,
one is just a symlink to the other). It helps to flesh out these kind
of issues.
--
-Paul Iadonisi
Senior System Administrator
Red Hat Certified Engineer / Local Linux Lobbyist
Ever see a penguin fly? -- Try Linux.
GPL all the way: Sell services, don't lease secrets
9:16 a.m.
Am Mo, den 11.10.2004 schrieb Paul Iadonisi um 5:24:
Not true...just set allowplaintext to 'no' in your
/etc/imapd.conf
(for Cyrus). If you're imap server uses SASL for network
authentication, it should the same setting, but possibly a different
filename path for imap servers other than cyrus. When you set this
option, the LOGINDISABLED capability will show up in the IMAP CAPABILITY
command, which does what the name implies. After STARTTLS is
negotiated, another CAPABILITY command will show that LOGINDISABLED is
no longer there, allowing login to proceed.
Thank you for this hint!
As an FYI, even if you're not using cyrus-imapd, the
cyrus-imapd-utils
package can come in very handy...especially imtest and smtptest (really,
one is just a symlink to the other). It helps to flesh out these kind
of issues.
Yes, I know both tools. smtptest already helped me one to solve a
problem with SASLv2 and Sendmail.
-Paul Iadonisi
Alexander
--
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 2 (Tettnang) kernel 2.6.8-1.521smp
Serendipity 16:15:23 up 11 days, 18:41, load average: 1.12, 1.22, 1.22
3:45 a.m.
On Mon, 2004-10-11 at 05:17 +0200, Alexander Dalloz wrote:
Am Mo, den 11.10.2004 schrieb Sam Varshavchik um 4:53:
> > Which IMAP server offers IMAP/TLS on port 143?
>
> Pretty much all of them.
Ok, I always configures IMAPs with usage of port 993, simply because
otherwise you can't force the users to use the secured connection.
I don't actually have an imapd listening on _either_ port 143 or 993.
Instead, mail clients are configured to 'ssh $mailserver exec imapd' and
authentication is done by ssh-agent/ssh-askpass.
This works fine with Evolution, Pine, Mutt, etc., and I can even use
'ssh -C' to get compression as an added bonus... does it work with
Thunderbird?
--
dwmw2
10:06 p.m.
Paul Iadonisi wrote:
This is probably an upstream problem, but I'm just putting my
feelers
out to see if I'm missing something, or thunderbird is missing something
I consider absolutely essential. And that's what my subject states.
Thunderbird (and Mozilla-Mail, for that matter) doesn't seem to support
STARTTLS for IMAP. No, I'm not talking about IMAPS (port 993), but
honest to goodness STARTTLS over port 143 like it should.
So is it me, or is thunderbird really lacking in this area?
If you want to know things like this in the future, all you have to do is
head over to bugzilla.mozilla.org, enter "STARTTLS" in the box and check
out the results. The first bug you are given is
60377 [RFE] Support IMAP STARTTLS command.
10:13 p.m.
On Sun, 2004-10-10 at 23:06, Christopher Aillon wrote:
[snip]
If you want to know things like this in the future, all you have to
do is
head over to bugzilla.mozilla.org, enter "STARTTLS" in the box and check
out the results. The first bug you are given is
60377 [RFE] Support IMAP STARTTLS command.
Doh! Thanks. Bugzilla. Who'd-a-thunk it. I was googling around but
it never occurred to me to just check their bugzilla.
--
-Paul Iadonisi
Senior System Administrator
Red Hat Certified Engineer / Local Linux Lobbyist
Ever see a penguin fly? -- Try Linux.
GPL all the way: Sell services, don't lease secrets
7159
days inactive
7159
days old
10 comments
6 participants
participants (6)
-
Alan Cox -
Alexander Dalloz -
Christopher Aillon -
David Woodhouse -
Paul Iadonisi -
Sam Varshavchik