Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a web server that also is my mail server - running dovecot and exim4. I currently have 5 open ports that have to do with serving mail, it seems very excessive to me. Its a dedicated box, I have root access - and most importantly I have control over everyone who receives mail from the box - so I can tell them to configure their mail clients any which way I prefer.

25/tcp    open     smtp
110/tcp   open     pop3
143/tcp   open     imap
993/tcp   open     imaps
995/tcp   open     pop3s

Questions:

What is the most secure way to serve mail?

Can I close ports 110 and 143, and just tell everyone to set their clients to receive on 993 and 995?

Is the mail served out of 993/995 fully encrypted, ie: not able to be eaves-dropped?

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

What is the most secure way to serve mail?

We could get into a whole PGP / SMIME discussion, but yeah, SSL/TLS are fine for client communication.

Can I close ports 110 and 143, and just tell everyone to set their clients to receive on 993 and 995?

Yes. I'd go one better and just do IMAP/S - POP is bad.

Is the mail served out of 993/995 fully encrypted, ie: not able to be eavesdropped?

Well, you could potentially configure them to be non-encrypted on those ports.. but yes, those listeners should be enforcing SSL/TLS encryption for all client communication.

Note that those 4 are all for communication with email clients - port 25, SMTP, has optional encryption that's not widely implemented; your client communication may be hidden, but your relay communication is unlikely to be.

share|improve this answer
4  
sendmail is pretty good about issuing STARTTLS if it sees support for it listed in the remote site's banner. That may be the only nice thing anyone has ever said about sendmail. –  voretaq7 Jan 27 '12 at 23:24
    
I forgot to mention Port 587 - submission. Thats open too! Is that the encrypted version of 25/smtp? –  bMon Jan 27 '12 at 23:29
    
SSL is, hmm, weird with SMTP. The SSL SMTP port is 465. A mail client can request SSL by issuing STARTTLS on both ports 25 and 587, but it's not "required". You can make it required on 587 since you should only be talking to clients (mail user agents). Making it required on 25 will break things, since mail servers use that port to relay to other mail servers, and they typically don't expect encryption. –  cjc Jan 28 '12 at 2:29
add comment

993 and 995 are the ports for IMAP-over-SSL and POP3-over-SSL, respectively.

It is actually possibly to use 110 and 143 using TLS, and therefore encrypted. This is easily enabled in Dovecot. In fact, when Dovecot talks about "SSL" it actually means both SSL and TLS, so if you have ssl = yes in your Dovecot config, TLS should already be enabled.

If you want to disable plaintext authentication, set ssl=required and disable_plaintext_auth=yes.

share|improve this answer
add comment

Right. Configure dovecot to ignore pop3 and imap in favor of pop3s and imaps and you'll prevent folks from grabbing passwords (and e-mail content) by sniffing those ports. You should be migrating folks away from pop in any case, as it usually has very silly implementations.

You should also configure exim to not allow authentication on port 25 connections (and to listen to 465 for SSL-encrypted SMTP) and to demand authentication before it allows a relayed message.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.