Re: [Imap-uw] Selectively forcing SSL access for IMAP and POP

[Matt Selsky]

We patched imapd and pop3d to use a slightly different different PAM service name if using an insecure login. Then we had PAM check a group to see if that user was still permitted to use insecure services. When we finally had all users doing secure logins we removed the patch. This patch changes the PAM service name and syslogs the insecure logins for POP3. You can do something very similar for IMAP, but I don't have that patch handy.

--
Matt

I have some server configured soas to allow both insecure POP/IMAP and POP/IMAP over SSL. We are using UW IMAP and PAM for authentication.

So,



* Are there other suggestions that are clean?



Any suggestions are very welcome.

What I would like to do is force *selected* users to only be allowed to login via the SSL ports. I know I can do this by putting these people on a different server and either blocking the insecure ports or compiling imap/pop to only allow SSL; however, this is not an option.... they have to stay on the same server as other users who do want to use insecure logins. * Is there some way to use different PAM files for SSL and non-SSL connections? If so, we could use PAM-Listfile to allow or deny access on a per-user basis. I suppose a "dirty" solution would be to hack the authentication part of imapd to do a pam-listfile similar thing ... knowing if the login is using SSL or not. However, I prefer to keep my IMAPd code as close as possible to the source distribution.

block-insecure-pop3.patch
Description: Binary data

_______________________________________________
Imap-uw mailing list
Imap-uw@u.washington.edu
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw