How to use SquirrelMail and Require SSL for IMAP Service?

Question

Hello,
Mac OS X Server v.10.4.9 – Open Directory Master
Providing POP, IMAP, SMTP, web services including webmail via SquirrelMail.
PHP v.4.4.4 Nov. 1, 2006
OpenSSL v.0.9.7l Sept. 2006
I need to require SSL for IMAP access, however, I also need to provide webmail access. SquirrelMail does support TSL it seems and that can be configured from /etc/squirrelmail/config/conf.pl and is discussed briefly here: http://www.squirrelmail.org/wiki/SquirrelMailIMAPS .
When I turn on TSL on SquirrelMail and change the IMAP port number to 993 attempting to log into SquirrelMail provides the following error:
Bad request: IMAP server does not appear to support the authentication method selected. Please contact your system administrator.
According to the above noted page from the SquirrelMail site one needs PHP 4.3 and SSLv3 in order for TSL to work, one must also connect to the IMAP server over port 993. Requirements I appear to meet.
So – how can one require the use of SSL for IMAP and still provide webmail access via SquirrelMail?
I have reviewed these three threads:
http://discussions.apple.com/thread.jspa?threadID=912841&tstart=75
http://discussions.apple.com/thread.jspa?messageID=1457773&#1457773
http://discussions.apple.com/thread.jspa?messageID=3921004&#3921004
However they do not answer the fundamental question of how to use SquirrelMail with SSL required by IMAP. Essentially the conversation revolves around working around the SSL requirement or forgoing it.
Thank you for any assistance.

Answer 1

David,
Yet from time to time these same users are in a
circumstance where they need to use webmail, thus
SquirrelMail needs to work. I am not trying to
secure webmail by requiring SSL.
I see, your problem. In this particular case there is a workaround.
Use different ports for postfix and cyrus limited to localhost, thus catering only to SquirrelMail, thus not needing TLS.
Roughly do this (this is just off the top of my head, may contain errors):
For SMTP / Postfix:
Edit /etc/postfix/master.cf
and add:
465 inet n - n - - smtpd
-o smtpdrecipientrestrictions= permit_mynetworks,reject
-o mynetworks=127.0.0.1/32
-o smtpdenforcetls=no
# This will create a port 465 (if you use this alreay pick another one. choose the number wisely, depending ony what is in use on your server)
# This port is only accessible to IP number in "mynetworks"
For IMAP / Cyrus
Edit /etc/cyrus.conf and add (below imap):
imaplocal cmd="imapd -C /etc/imapd-local.conf" listen="127.0.0.1:imap" prefork=0
Next duplicate /etc/imapd.conf and name it imapd-local.conf
Edit /etc/imapd-local.conf
Change
tlsserveroptions: require
to
tlsserveroptions: use
Next edit:
/etc/services
and create a port called "imaplocal"
(you could probably recycle 585 wich is deprecated, check what is in the services file, make sure no duplicate port numbers).
should look something like:
imaplocal 585/udp
imaplocal 585/tcp
When done with all config files:
Save & restart mail services
Point SquirrelMail to the new ports wich should only be accessible to localhost (check with an external client if it holds
Sorry for the "draft style" post, but I don't have much time.
Just ask, if anything isn't clear.
HTH,
Alex