[Dovecot] Question about Client Certificates
Hi,
I have a simple dovecot installation, version 1.2.12 of ubuntu 10.10. I also have a straightforward newbie question! I've hunted in the wiki and on the wider web, but not yet found a solution.
Current status: I have successfully configured imap with tls, accessed on port 993, and for security require a valid client certificate to be presented, using ssl_require_client_cert and ssl_verify_client_cert. This is all working fine!
Now I want to add a SquirrelMail service to the same server. This will connect using IMAP over port 143, without TLS. My question is: how do I achieve this!
At the moment, I simply get the following in the logs:
Aborted login (cert required, client didn't start TLS): method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
If I comment out the "ssl_require_client_cert = yes" in the auth default section, SquirrelMail then works fine … but I can also connect remotely without presenting a valid certificate, which is no good!
At the moment I have a single auth section in dovecot.conf, the "auth default { ... }" section. I wondered if I need a second section, which does not have the ssl requirement inside it. Is that right? If so, how do I link one auth section to the imaps service, and the other to the imap service (listening only on localhost)?
In other words, I want "ssl_require_client_cert = yes" for remote connections (on port 993), but "ssl_require_client_cert = no" for local connections using non-tls imap on port 143. Is this possible?
Hope that late-night explanation makes sense, and hope somebody can point me in the right direction, thanks in advance!
-- Bill Gallafent.
On Mon, 18 Oct 2010 23:17:40 +0100 William Gallafent <william@gallaf.net> articulated:
Current status: I have successfully configured imap with tls, accessed on port 993, and for security require a valid client certificate to be presented, using ssl_require_client_cert and ssl_verify_client_cert. This is all working fine!
Out of curiosity, why are you forcing port 993 if you are using TLS? I have basically the same setup; however, I use port 143 instead. It helps to eliminate the potential problem with an end user failing to change the port number.
-- Jerry ✌ Dovecot.user@seibercom.net
Disclaimer: off-list followups get on-list replies or get ignored. Please do not ignore the Reply-To header.
At no time is freedom of speech more precious than when a man hits his thumb with a hammer.
Marshall LumsdenOn 18 October 2010 23:52, Jerry <dovecot.user@seibercom.net> wrote:
On Mon, 18 Oct 2010 23:17:40 +0100 William Gallafent <william@gallaf.net> articulated:
Current status: I have successfully configured imap with tls, accessed on port 993, and for security require a valid client certificate to be presented, using ssl_require_client_cert and ssl_verify_client_cert. This is all working fine!
Out of curiosity, why are you forcing port 993 if you are using TLS? I have basically the same setup; however, I use port 143 instead. It helps to eliminate the potential problem with an end user failing to change the port number.
I keep port 143 firewalled, closed to all except localhost! The original plan was that that port would accept only unencrypted connections, 993 only encrypted. But you're right, as I gradually understand things better, I see that I can just use 143 for both classes of connection (once I work out how to configure it!) would be fine.
- if localhost allow any type of connection
- if not localhost require TLS with a valid client cert
In fact, that restates the problem very succintly! The part that seems to break is that when I _require_ a valid client cert, I can no longer make unencrypted connections from localhost. I'm sure there must be a straightforward way to do this!
-- Bill Gallafent.
On Mon, 2010-10-18 at 23:17 +0100, William Gallafent wrote:
In other words, I want "ssl_require_client_cert = yes" for remote connections (on port 993), but "ssl_require_client_cert = no" for local connections using non-tls imap on port 143. Is this possible?
With v2.0, yes. With v1.2 .. I guess not unless you run two Dovecot instances with two different config files.
participants (3)
-
Jerry
-
Timo Sirainen
-
William Gallafent