Re: [Dovecot] Enforcing TLS

2009-01-09 Thread Jan-Frode Myklebust
On Fri, Jan 09, 2009 at 09:25:46AM -0500, Stewart Dean wrote: > Dunno if I'm talking about the right thing or if this would help, but... > > we have gone over to a single wildcard certficate for everything in the > *.bard.edu domain (from Digicert)...this costs $495 for a single year, > less fo

Re: [Dovecot] Enforcing TLS

2009-01-09 Thread Timo Sirainen
On Jan 9, 2009, at 6:34 AM, Jan-Frode Myklebust wrote: We have the opposite requirement... Is it possible to enable SSL on the POPS/IMAPS-port, without also enabling STARTTLS on the POP/IMAP ports? Not currently unless you run two Dovecot installations with different configuration files.

Re: [Dovecot] Enforcing TLS

2009-01-09 Thread Stewart Dean
Dunno if I'm talking about the right thing or if this would help, but... we have gone over to a single wildcard certficate for everything in the *.bard.edu domain (from Digicert)...this costs $495 for a single year, less for multiple years. Then everything coming at a machine of the format: .

Re: [Dovecot] Enforcing TLS

2009-01-09 Thread Giuliano Gavazzi
On F 9 Jan, 2009, at 13:11 , Giuliano Gavazzi wrote: On T 6 Jan, 2009, at 14:59 , Ed Schouten wrote: My question: is there support to enforce TLS when people connect to non-SSL ports? If someone comes up with a solution, I'll add it to the SSL article on the Wiki. I'm using Dovecot 1.1.7

Re: [Dovecot] Enforcing TLS

2009-01-09 Thread Giuliano Gavazzi
On T 6 Jan, 2009, at 14:59 , Ed Schouten wrote: My question: is there support to enforce TLS when people connect to non-SSL ports? If someone comes up with a solution, I'll add it to the SSL article on the Wiki. I'm using Dovecot 1.1.7, installed on a FreeBSD 6.4-STABLE system. not sure I un

Re: [Dovecot] Enforcing TLS

2009-01-09 Thread Jan-Frode Myklebust
On 2009-01-06, Timo Sirainen wrote: > >> I already asked on IRC whether this was possible, because I was unable >> to find this on the Wiki. It turns out there is a configuration switch >> called `disable_plaintext_auth', but looking at the description this >> only prevents people from using plain

Re: [Dovecot] Enforcing TLS

2009-01-06 Thread Ed Schouten
* Timo Sirainen wrote: > Have you enabled non-plaintext authentication? If not, then > disable_plaintext_auth practically does what you want, because you can't > authenticate without SSL/TLS. Oh, great. I don't know a lot of IMAP/POP3-internals, but I was unsure whether `disable_plaintext_auth' s

Re: [Dovecot] Enforcing TLS

2009-01-06 Thread Timo Sirainen
On Tue, 2009-01-06 at 14:59 +0100, Ed Schouten wrote: > I've happily been using Dovecot for a couple of years now, but only a > couple of days ago I configured it to speak both TLS and SSL for both > POP3 and IMAP. Ideally I want users to use TLS, but I've enabled SSL, > because some mailers (at le