>Although I'm satisfied that our new IMail server is secure, I have one user
>who sent me the following message when he found out what we were using...
>
> " ... I would like to have security. POP3
> exposes my password and my mail contents. "
>
>I don't know what he's talking about. Can anyone advise me on this one?
SMTP and POP protcols send mail in cleartext, except SMTP AUTH with CRAM MD5 which
encrypts the passwords.
Imail doesn't support it, but I think you can 'wrap' the POP3 sessions in SSL like
you can wrap http in SSL. needs to be done on both ends of course, but does work.
read up at www.stunnel.org
The result is that the POP3 session is encrypted and your client can relax. This of
course is additional computer burden on your Imail server and can be a serious drag on
performance so if you do a lot of TLS POP3 sessions with encryption by the main CPU,
this can slow down the mail server. Either get a CPU with much higher MHz or add
hardware encryption board to offload encryption from main cpu. Putting all these bits
together is not trivial.
Note that there is an RFC for TLS (Transport Layer Security, successor to SSL) that
can be patched into IMGate/postfix for encrypted server-to-server mail delivery
between participating SMTP servers. extended SMTP supports this TLS action also.
We'll see if Imail7 does. If not, this is another feature that IMGate brings to the
dance.
Len
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
