Secure POP3 - Secure IMAP
|
|
| Minimum POP Mail Security |
- Harden the POP server as if it was a secure firewall
- Run Secure POP3s ( 995 ) and Secure IMAPs ( 993 ) daemons
- do NOT use insecure pop3 ( port 110 )
- do NOT use insecure imap ( port 143 )
- Restrict POP emails only from certain ip# ( /etc/hosts.allow )
- All loginID should all be different
- loginID, emailID, pppID, vpnID, wirelessID ..
- All passwd should all be different
- preferably machine generated to guarantee randomness
and a "good non-guessable" passwd
- do NOT let employee's use passwd at their (insecure) home PCs
- Let's assume a User named "John Smith"
- his email could be "jsmith@your-domain.com
- his login id at any PC should be different ( john )
- different ID from the email address
- Assume that ALL wireless transmissions has already been sniffed by your competitors
- Never put your email/POP servers at your colo facility
- Locally encrypt all sensitive emails before sending/receiving
- Never send/read corporate emails outside of the corp firewalls
- do NOT use hotmail, excite, yahoo email accounts for corp business
- Netscape, Mozilla, Outlook, users..
- First test regular pop3 ( 110 ) or regular imap ( 143 )
- tests login and passwd and network all works fine
- Than, Turn on "SSL" options for secure POP3, secure IMAP
|
| RFCs and Port Numbers |
ietf.org RFC 821 Simple Mail Transfer Protocol
ietf.org RFC 918 POST OFFICE PROTOCOL
ietf.org RFC 937 POST OFFICE PROTOCOL - VERSION 2
ietf.org RFC 974 Mail Routing and the Domain System
ietf.org RFC 1081 Post Office Protocol - Version 3
ietf.org RFC 1123 Simple Mail Transfer Protocol v2
ietf.org RFC 1869 SMTP Service Extensions ( esmtp )
ietf.org RFC 1939 Post Office Protocol - Version 3 (STD 53)
ietf.org RFC 1957 Some Observations on Implementations of the Post Office Protocol (POP3)
ietf.org RFC 2033 Local Mail Transfer Protocol
ietf.org RFC 2192 IMAP
ietf.org RFC 2195 IMAP/POP AUTHorize Extension for Simple Challenge/Response
ietf.org RFC 2246 TLS Protocol version 1.0
ietf.org RFC 2384 POP URL Scheme
ietf.org RFC 2449 POP3 Extension Mechanism
ietf.org RFC 2487 SMTP Service Extension for Secure SMTP over TLS
ietf.org RFC 2476 Message Submission
ietf.org RFC 2554 SMTP Auth
ietf.org RFC 2595 Using TLS with IMAP, POP3 and ACAP
ietf.org RFC 2821 SMTP
ietf.org RFC 3206 The SYS and AUTH POP Response Codes
ietf.org RFC 4346 TLS - Transport Layer Security
ietf.org RFC 4422 SASL - Simple Authentication and Security Layer
ietf.org RFC 4954 SMTP Service Extension for Authentication
ietf.org RFC 5034 The Post Office Protocol (POP3) Simple Authentication and Security Layer (SASL) Authentication Mechanism
|
|
Port Number
|
Service/Function
|
|
20
|
ftp-data
|
|
21
|
ftp
|
|
22
|
ssh
|
|
23
|
telnet
|
|
25
|
smtp
|
|
109
|
pop2
|
|
110
|
pop3
|
|
143
|
imap
|
|
443
|
Secure http ( https )
|
|
465
|
Secure smtp ( smpts )
|
|
587
|
Submission Agent
|
|
989
|
Secure ftp-data ( ftps-data )
|
|
990
|
Secure ftp ( ftps-control )
|
|
992
|
Secure telnet ( telnets )
|
|
993
|
Secure imap ( imaps )
|
|
995
|
Secure pop3 (pop3s)
|
|
|
|
| pop3s vs imaps |
wikipedia.org POP = Post Office Protocol
wikipedia.org imap = Internet Message Access Protocol
- secure pop3
- all your email is offloaded from your pop server onto your PC/laptop
- your emails will be spread out amongst all the various PC/laptop you used to view your email
- secure imap
- all your email remains on your imap server
- you can access all your past emails and new unread emails from any PC/laptop
|
| Additional SW Required for Secure POP3/IMAP |
|
| Secure POP3/IMAP Daemons |
|
| Testing Secure POP3 Servers |
Linux-Sec.net/Sniffer Sniffing pop3/imap email connections
imapwiki.org IMAP Server compliancy status
LinuxMail.info testing pop3 with telnet
vanemery.com testing pop3s with openssl
/usr/bin/pop3test localhost:pop3
- Tests that loginID and passwd is working properly
- type "quit" to exit the telnet test
telnet localhost 110 -- regular POP3 should work
telnet localhost 143 -- regular IMAP should work
- Telnet into a secure Server will fail due to wrong protocol
telnet localhost 993 -- secure POP3s fails
telnet localhost 995 -- secure IMAPs fails
- Test with openssl or ssl-capable clients
openssl s_client -connect $HOST:$PORT
stunnel -c -r 1.2.3.4:995
- Use a SSL-capable client to do further Secure POP3/Secure IMAP testing
- netscape, mozilla, pine, mutt(?), MS outlook, ...
Brute Force Testing POP3 passwd
|
| Configuring Secure POP3 Clients -- Linux |
- Use Netscape/Mozilla email clients w/ SSL enabled
- Secure POP3 from remote POP servers
tLDP.org SecurePOP + SSH
- ssh -C -f popserver -L 11110:popserver:110 sleep 5
- ssh -q -L 4025:SMTP_MailServer:25 4110:POP3_Server:110 user@POP3_Server
- telnet localhost 11110
Qref.SourceForge.net POP3 Port Forwarding
This is a secure way to make connections to SMTP/POP3 servers over the Internet
- ssh -q -L 4025:remote-server:25 4110:remote-server:110 username@remote-server
PPPL.gov stuff
Redhat.com SSH Port Forwarding
- Secure IMAP over ssh
- ssh -q -L 3000:localhost:143 Imap_Server.domain.com
Redhat.com SSH + imapd
|
| Configuring Secure POP3 Clients -- MS Windoze |
|