Require SSL for IMAP (and possibly, SMTP)

Question

Level 1

119 points

Require SSL for IMAP (and possibly, SMTP)

Hello,

I'm having quite a bit of trouble changing the server configuration to require SSL for IMAP connections on the server side. (Ideally, I'd like to require SMTP to send email as well, but not require for outbound connections from other hosts as it may stop message delivery.)

If anyone has had luck doing this on OS X Mountain Lion / Server.app it would be great if you could share your steps?

Thx.

Mac mini Server (Mid 2011), OS X Mountain Lion (10.8.2)

Posted on Sep 15, 2013 1:39 PM

Reply

Answer 1

Camelot

Level 9

54,333 points

Sep 15, 2013 10:48 PM in response to Matt Domenici

It would be helpful is you could explain what your experience is, since there are many possibilities and knowing what you're encountering would help.

The most obvious/common issue is that IMAPS (IMAP+SSL) uses port 993, not the normal IMAP 143.

If your clients are configured to only use 143 then they will break until they're reconfigured to use 993.

Since you don't mention whether you've checked port numbering, it's impossible to tell if that's your issue or not.

As for SMTP, if your mail server accepts mail from any external hosts then you do NOT want to require SSL. Few, if any, remote mail servers support SSL for SMTP, so you'll just block any external servers from sending mail to your domain. I doubt your users want that.

Reply

Answer 2

Matt Domenici Author

Level 1

119 points

Sep 21, 2013 12:59 PM in response to Camelot

Although the OS X Server Admin UI doesn't provide the feature any longer, you can add:

disable_plaintext_auth=yes

to 10-ssl.conf in the dovecot config directory to allow plaintext after SSL is initiated. This seems to work okay, but randomly fails. Not certain as to why.

Then there's SMTP. I don't want to require SSL for SMTP for inbound email; just email that needs to be relayed elsewhere.

This is where I am having some trouble. Any tips would be appreciated.

Reply

Answer 3

Matt Domenici Author

Level 1

119 points

Sep 21, 2013 2:00 PM in response to Matt Domenici

I missed the SMTP key here; smtpd_tls_auth_only = yes does the trick; for clients trying to auth it will require SSL only, which does what I needed it to do.

Still not clear why it's a bit unreliable; seems to be a different issue.

Reply