Linux Security Cookbook [Electronic resources] نسخه متنی

Recipe 8.14 Securing POP/IMAP with stunnel and SSL

8.14.1 Problem

You want to read mail on a

POP or IMAP mail server securely. Your mail
client supports SSL, but the mail server does not.

8.14.2 Solution

Use stunnel, installed on the mail server machine.
Suppose your client host is

myclient , the mail server host is

mailhost , and the mail
server listens on standard port numbers (110 for POP, 143 for IMAP).

1. Generate a self-signed X.509
   
   certificate
   foo.crt, with private key in
   foo.key. [Recipe 4.8]




2. Place the certificate and key into a single file:

   $ cat foo.crt foo.key > foo.pem
   $ chmod 600 foo.pem




3. Choose an arbitrary, unused TCP port number on

   mailhost , such as 12345.




4. Run this stunnel process on

   mailhost for a POP server, supplying the
   certificate's private-key passphrase when prompted:

   mailhost$ /usr/sbin/stunnel -p foo.pem -d 12345 -r localhost:110 -P none -f
   2003.03.27 15:07:08 LOG5[621:8192]: Using 'localhost.110' as tcpwrapper service name
   Enter PEM pass phrase: ********
   2003.03.27 15:07:10 LOG5[621:8192]: stunnel 3.22 on i386-redhat-linux-gnu 
   PTHREAD+LIBWRAP with OpenSSL 0.9.6b [engine] 9 Jul 2001
   2003.03.27 15:07:10 LOG5[621:8192]: FD_SETSIZE=1024, file ulimit=1024->500 
   clients allowed

   For an IMAP server, use port 143 instead of 110.




5. Add

   foo.crt to the client's
   list of trusted certificates, in whatever way is appropriate for the
   client software and OS. You may need to convert the certificate
   format from PEM to DER: [Recipe 4.10]

   $ openssl x509 -in foo.crt -out foo.der -outform der




6. Configure your mail client on myclient to connect to port 12345 of
   mailhost using SSL.

8.14.3 Discussion

This recipe assumes you are not a system administrator on

mailhost , and need to get this working
just for yourself. If you have root privileges, just configure your
mail server to support SSL directly.

We create two secure connections to

mailhost 's port 12345.
The stunnel command connects this arbitrary port
to the mail server, all locally on

mailhost . Then the mail client crosses
the network via SSL to connect to port 12345. These two segments
together form a complete, secure connection between mail client and
mail server.

If you remove the
-f option, stunnel will fork
into the background and log messages to syslog,
instead of remaining on the terminal and printing status messages to
stderr.

8.14.4 See Also

The directory /usr/share/doc/stunnel-* contains
stunnel documentation. The
stunnel home page is http://www.stunnel.org.