[Dovecot] SSL only for external connections
If SSL/TLS works from the outside, but not the inside, you should
probably find out why and fix that instead.
What is the actual error text?
Terry
-- Terry Carmen CNY Support, LLC https://www.cnysupport.com
-----Original Message----- From: dovecot-bounces@dovecot.org [mailto:dovecot- bounces@dovecot.org] On Behalf Of Terry Carmen
If SSL/TLS works from the outside, but not the inside, you should probably find out why and fix that instead.
You'd think so - but since I don't actually need TLS from the inside, and given my skill level - disabling it seems easier :)
What is the actual error text?
2011-09-29T15:33:14-04:00 WARN: HORDE4 [imp] PHP ERROR: fwrite(): SSL: Broken pipe [pid 23503 on line 3716 of "/usr/share/php/Horde/Imap/Client/Socket.php"] 2011-09-29T15:33:14-04:00 WARN: HORDE4 [imp] PHP ERROR: fwrite() expects parameter 1 to be resource, null given [pid 23503 on line 3714 of "/usr/share/php/Horde/Imap/Client/Socket.php"] 2011-09-29T15:33:14-04:00 WARN: HORDE4 [imp] PHP ERROR: fwrite() expects parameter 1 to be resource, null given [pid 23503 on line 3716 of "/usr/share/php/Horde/Imap/Client/Socket.php"] 2011-09-29T15:33:14-04:00 WARN: HORDE4 [imp] PHP ERROR: feof() expects parameter 1 to be resource, null given [pid 23503 on line 3909 of "/usr/share/php/Horde/Imap/Client/Socket.php"] 2011-09-29T15:33:14-04:00 WARN: HORDE4 [imp] PHP ERROR: fgets() expects parameter 1 to be resource, null given [pid 23503 on line 3925 of "/usr/share/php/Horde/Imap/Client/Socket.php"] 2011-09-29T15:33:14-04:00 ERR: HORDE4 [imp] IMAP server denied authentication. [pid 23503 on line 340 of "/usr/share/horde4/imp/lib/Imap.php"] 2011-09-29T15:38:05-04:00 ERR: HORDE4 [imp] Server does not support TLS connections. [pid 23596 on line 340 of "/usr/share/horde4/imp/lib/Imap.php"]
The mail log (to which Dovecot logs) shows nothing for either of those time periods - and a single (successful) login with TLS at 15:33:15 - The consensus from the excellent Horde mailing list is that it's either an IMAP issue or a PHP one. Since the dovecot log isn't showing any errors I'm inclined to believe it's PHP. And since I have neither the skills nor the time to engage with those folks on the intricacies of fwrite, fget and feof, I'd rather just not have the TLS overhead on localhost connections (which probably makes sense even if I did have the inclination).
So, would setting ssl_listen to the external IP remove the TLS offer from localhost connections?
Simon
On 09/30/11 18:15, Terry Carmen wrote:
If SSL/TLS works from the outside, but not the inside, you should probably find out why and fix that instead.
What is the actual error text?
In my limited experience there are two main reasons why it can work from outside but not inside. One is a routing problem. The common problem is trying to connect from inside using the outside IP address where the replies try to take a different route back.
The second reason is to do with the SSL certificate which will have a CN indicating the server name. If you try to connect from the inside the server name will not match and you'll get a certificate error.
A third possibility is you're trying to use TLS on an SSL connection. You need to use port 143 for TLS and 993 for SSL.
However your error messages show an authentication error and I suspect you are using an encrypted password on a connection that doesn't support it. It's fairly common if TLS is demanded that PLAIN auth is the only method accepted.
Without more detail one can only guess.
Dick
-----Original Message----- From: dovecot-bounces@dovecot.org [mailto:dovecot- bounces@dovecot.org] On Behalf Of Dick Middleton On 09/30/11 18:15, Terry Carmen wrote:
If SSL/TLS works from the outside, but not the inside, you should probably find out why and fix that instead.
What is the actual error text?
In my limited experience there are two main reasons why it can work from outside but not inside. One is a routing problem. The common problem is trying to connect from inside using the outside IP address where the replies try to take a different route back.
The second reason is to do with the SSL certificate which will have a CN indicating the server name. If you try to connect from the inside the server name will not match and you'll get a certificate error.
A third possibility is you're trying to use TLS on an SSL connection. You need to use port 143 for TLS and 993 for SSL.
However your error messages show an authentication error and I suspect you are using an encrypted password on a connection that doesn't support it. It's fairly common if TLS is demanded that PLAIN auth is the only method accepted.
Without more detail one can only guess.
- No.
- Yes.
- No.
Your postulation about the certificate is a good one. The weird thing is that the error is not consistent, which is why I hadn't caught it before I was idly trawling through the logs.
As Michael says - I can (and probably should) turn this off in the horde config.
But the question remains - if only because it's now there - how does one limit services effectively in Dovecot. In Courier it was fairly easy and well documented. There's no reason for me to offer IMAPS or POP3S to localhost (because of the certificate issue) and there's also no reason for me to offer POP3 to localhost either.
For posterity and for my own edification it would be nice to know how to do that.
Thanks for the help and input.
Simon
participants (3)
-
Dick Middleton
-
Simon Brereton
-
Terry Carmen