Email server port options

Question

I have a web server that also is my mail server - running dovecot and exim4. I currently have 5 open ports that have to do with serving mail, it seems very excessive to me. Its a dedicated box, I have root access - and most importantly I have control over everyone who receives mail from the box - so I can tell them to configure their mail clients any which way I prefer.

25/tcp    open     smtp
110/tcp   open     pop3
143/tcp   open     imap
993/tcp   open     imaps
995/tcp   open     pop3s

Questions:

What is the most secure way to serve mail?

Can I close ports 110 and 143, and just tell everyone to set their clients to receive on 993 and 995?

Is the mail served out of 993/995 fully encrypted, ie: not able to be eaves-dropped?

Answer 1

What is the most secure way to serve mail?

We could get into a whole PGP / SMIME discussion, but yeah, SSL/TLS are fine for client communication.

Can I close ports 110 and 143, and just tell everyone to set their clients to receive on 993 and 995?

Yes. I'd go one better and just do IMAP/S - POP is bad.

Is the mail served out of 993/995 fully encrypted, ie: not able to be eavesdropped?

Well, you could potentially configure them to be non-encrypted on those ports.. but yes, those listeners should be enforcing SSL/TLS encryption for all client communication.

Note that those 4 are all for communication with email clients - port 25, SMTP, has optional encryption that's not widely implemented; your client communication may be hidden, but your relay communication is unlikely to be.

Answer 2

993 and 995 are the ports for IMAP-over-SSL and POP3-over-SSL, respectively.

It is actually possibly to use 110 and 143 using TLS, and therefore encrypted. This is easily enabled in Dovecot. In fact, when Dovecot talks about "SSL" it actually means both SSL and TLS, so if you have ssl = yes in your Dovecot config, TLS should already be enabled.

If you want to disable plaintext authentication, set ssl=required and disable_plaintext_auth=yes.

Answer 3

Right. Configure dovecot to ignore pop3 and imap in favor of pop3s and imaps and you'll prevent folks from grabbing passwords (and e-mail content) by sniffing those ports. You should be migrating folks away from pop in any case, as it usually has very silly implementations.

You should also configure exim to not allow authentication on port 25 connections (and to listen to 465 for SSL-encrypted SMTP) and to demand authentication before it allows a relayed message.