Chris Tyler - Fedora Linux

Buying a certificate is not covered in this lab.

Create your own certificate

Because there is no way to verify the authenticity of the certificate (whether unsigned or self-signed) with a third party, most client programs will present a warning dialog every time a certificate of this type is encountered. However, the connection will still be encrypted.

Disable encryption

In all caseswhether encryption is disabled or notDovecot will accept unencrypted connections. If you are in a secure environment (for example, where the only client connecting to the Dovecot server is SquirrelMail on the local machine, or connections are made over a reasonably secure LAN such as a wired home network), you may decide to forgo encryption altogether.

First, edit the file /etc/pki/dovecot/dovecot-openssl.cnf and find the CN= and emailAddress= lines:

[ req ]

default_bits = 1024

encrypt_key = yes

distinguished_name = req_dn

x509_extensions = cert_type

prompt = no

[ req_dn ]

# country (2 letter code)

#C=FI

# State or Province Name (full name)

#ST=

# Locality Name (eg. city)

#L=Helsinki

# Organization (eg. company)

#O=Dovecot

# Organizational Unit Name (eg. section)

OU=IMAP server

# Common Name (*.example.com is also possible)

CN=imap.example.com

# E-mail contact

emailAddress=postmaster@example.com

[ cert_type ]

nsCertType = server

Edit these two lines to contain the hostname of the system and the mail administrator's email address:

# Common Name (*.example.com is also possible)

CN= bluesky.fedorabook.com

# E-mail contact

emailAddress= postmaster@fedorabook.com

Then generate the certificates:

# SSLDIR=/etc/pki/dovecot /usr/share/doc/dovecot-1.0/examples/mkcert.sh

To disable encryption, edit /etc/dovecot.conf and locate the ssl_disable line:

# Disable SSL/TLS support.

#ssl_disable = no

Uncomment this line and change the value to yes :

# Disable SSL/TLS support.

ssl_disable = yes

Start the dovecot service using the Services tool or from the command line:

# service dovecot start

If you are going to use IMAP or POP3 remotely, you will need to open some ports in your firewall. For IMAP, open ports for the IMAPandIMAPSservices (TCP ports 143 and 220); for POP3, open the POP3 and POP3S ports (TCP ports 110 and 995).

On the other hand, if you will be using the IMAP and POP3 services only with local applications such as SquirrelMailor local MTAs such as Evolution, you should close the IMAP and POP3 ports on your firewall.

Dovecot enables MUAs to access mailboxes over a network connection using the POP3 or IMAP protocols. POP3 is primarily used to fetch mail from a mailbox so that it can be used elsewhere; IMAP is used to manipulate email messages and folders while leaving them on the server.

Like SMTP, POP3 is a human-readable protocol, and you can use telnet to manually conduct a POP3 session to see how it works:

$ telnet bluesky.fedorabook.com pop3

Trying 172.16.97.102...

Connected to 172.16.97.102 (172.16.97.102).

Escape character is '^]'.

+OK Dovecot ready.

USER chris

+OK

PASS bigsecret

+OK Logged in.

LIST

+OK 2 messages:

1 615

2 609

.

RETR 1

+OK 616 octets

Return-Path:

Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])

by localhost.localdomain (8.13.5/8.13.5) with ESMTP id k232Hf26026693

for ; Thu, 2 Mar 2006 21:17:41 -0500

Received: (from root@localhost)

by localhost.localdomain (8.13.5/8.13.5/Submit) id k232HfOb026692

for chris; Thu, 2 Mar 2006 21:17:41 -0500

Date: Thu, 2 Mar 2006 21:17:41 -0500

From: Jason Smith

Message-Id: <200603030217.k232HfOb026692@localhost.localdomain>

To: chris@localhost.localdomain

Subject: Book Cover

Nice!

.

QUIT

+OK Logging out.

IMAP is also human-readable, but a bit more complex.

In its default configuration, Dovecot uses the input mailboxes in /var/spool/mail as the IMAP INBOX folder and the POP3 data source. This ensures that other applications (such as a local MUA like Evolution) can be used to access the same messages.

Dovecot creates these in the user's home directory.

 The Dovecot web site: http://dovecot.org

 The Dovecot Wiki: http://wiki.dovecot.org

 Documentation in /usr/share/doc/dovecot*

 The manpages for openssl , the library that handles encryption for dovecot

When you're on the move, it's nice to have consistent access to your email. If you set up SquirrelMail, you'll be able to access your email from any web browser.

Before you set up SquirrelMail, you'll need a working Apache configuration and the Dovecot IMAP server.

If you're using SELinux, you must permit web scripts to create network connections. Use the graphical SELinux configuration tool or enter this command:

# setsebool -P httpd_can_network_connect 1

If Apachewas running before you installed SquirrelMail, you'll need to restart or reload it so that it notices the SquirrelMail alias directive:

# service apache reload

Unless you have other computers on your local network that need to access IMAP, you can restrict remote access to the IMAP server using Fedora's firewall facilities.

You can now use SquirrelMail by accessing https:///webmail . The web page shown in Figure 7-21 should appear.

If you are using the default Apache SSL certificate (which is automatically up by default), you will get a warning from your browser when you first connect using https .

You can instead access http:///webmail to avoid that warning message, but your passwords and email may be read if someone intercepts your network communication.