On 8/8/06, Johannes Berg johannes@sipsolutions.net wrote:

Kresimir Tonkovic wrote:

...

Correct me if I'm wrong, by default POP3 and POP3+SSL both work at the same port, 110. I want to let local users connect by plain POP3 and external users to use POP3+SSL. I don't see how I can set this up using iptables and tcpwrappers. Can you please provide more details? Ah, so you don't want to use pop3s but pop3+starttls. Just tell dovecot to deny any password when used over insecure connections. local connections are considered secure.

johannes

I'm sorry, I'm new to dovecot, it seems my terminology is all wrong :-)

I assumed pop3s is pop3+ssl is pop3 over ssl.

In my config file (just an excerpt):

protocols = pop3 pop3s pop3_listen = 192.168.0.1 pop3s_listen = elag.hr

elag.hr is my domain name. It resolves to the current external IP address.

So when I connect from outside, my email client asks me to verify a ssl certificate. This enforced me to believe pop3s is pop3 over ssl, or as I called it above pop3+ssl.

If I'm wrong, what is pop3+starttls?

kresho

On 8/8/06, Johannes Berg johannes@sipsolutions.net wrote:

...

I assumed pop3s is pop3+ssl is pop3 over ssl. Yes, it is, but pop3s uses a different port than pop3. Try netstat -ltnp on your server :)

...

protocols = pop3 pop3s pop3_listen = 192.168.0.1 http://192.168.0.1 pop3s_listen = elag.hr http://elag.hr Just change that to

Kresimir Tonkovic wrote: pop3+tls is the recommended way of doing encryption now, which uses the same port as pop3 (110) but has a special STLS (I think) command to "upgrade" an unencrypted connection to a secure one. pop3s_listen = 0.0.0.0 and you should be fine completely if you want to continue using pop3s. If you want to switch to pop3+tls then you don't need pop3s at all.

johannes

Ok, if I switch to pop3+tls, how do I configure that in email clients? It seems that if I check "use SSL" in Outlook, Evolution, they connect to port 995 (pop3s).

kresho

Kresimir Tonkovic wrote:

Is that different from pop3s_listen = * ?

Yeah, * gives you IPv6 as well afaik :)

johannes