لطفا منتظر باشید ...
Recipe 8.11 Securing POP/IMAP with SSL and Pine
8.11.1 Problem
You want to secure your POP or IMAP
email session. Your mail client is pine, and your
mail server supports SSL.
8.11.2 Solution
Test whether you can use SSL for Securing Mail:
$ pine -inbox-path='{mail.server.net/user=fred/protocol}'replacing protocol with either
pop or imap as desired. One
of three outcomes will occur:
- You get no connection. In this case, you cannot use STARTTLS; move on
and try SSL-port, below. - You get a connection, but the login prompt includes the word
INSECURE:HOST: mail.server.net (INSECURE) ENTER LOGIN NAME [fred] :
In this case, you again cannot use STARTTLS; move on and try
SSL-port, below. - You get a connection and the login prompt does
not say INSECURE. In this
case, congratulations, you have a secure mail connection. You are
done.
If you could not use STARTTLS as shown, try the
SSL-port method:
$ pine -inbox-path='{mail.server.net/user=fred/protocol/ssl}'again replacing protocol with either
pop or imap as appropriate.To ensure you have a secure connection (i.e., to forbid
pine to engage in weak authentication, unless
it's over a secure connection), add
/secure to your inbox-path.
For example:
$ pine -inbox-path='{mail.server.net/user=fred/imap/secure}'If none of this works, your ISP does not appear to support IMAP over
SSL in any form; try SSH instead. [Recipe 8.16]
8.11.3 Discussion
You might be able to simplify the mailbox specifications; for
instance:
{mail.server.net/user=fred/imap}could be simply {mail} instead: IMAP is the
default, the usernames on both sides are assumed to be the same if
unspecified, and your DNS search path may allow using the short
hostname.
8.11.4 See Also
pine(1).
SSL Connection Problems: Server-Side DebuggingIf you have access to the system logs on the mail server, you can examine them to debug SSL connection problems, or just to verify what's happening. In /var/log/maillog, successful SSL-port-style connections look like this: Mar 7 16:26:13 mail imapd[20091]: imaps SSL service init from 209.225.172.154 as opposed to these, indicating no initial use of SSL: Mar 7 16:26:44 mail imapd[20099]: imap service init from 209.225.172.154 Note, however, that you cannot distinguish the success of STARTTLS-style security this way.Another way of verifying the secure operation is to watch the mail protocol traffic directly using tcpdumpRecipe 9.16] or Recipe 9.17]. Ethereal is especially good, as it understands all the protocols involved here and will show exactly what's happening in a reasonably obvious fashion. |
