Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can Nginx be an mail proxy for a backend server that does not accept cleartext logins?

Preferably I'd like to know what directive to include so that it will invoke STARTTLS/STLS, but communication via IMAPS or POP3S is sufficient.

relevant(?) section of nginx.conf

mail {
    auth_http           localhost:80/mailproxy/auth.php;
    proxy               on; 
    ssl_prefer_server_ciphers   on;
    ssl_protocols           TLSv1 SSLv3;
    ssl_ciphers         HIGH:!ADH:!MD5:@STRENGTH;
    ssl_session_cache       shared:TLSSL:16m;
    ssl_session_timeout     10m;
    ssl_certificate         /etc/ssl/private/hostname.crt;
    ssl_certificate_key     /etc/ssl/private/hostname.key;
    imap_capabilities  "IMAP4rev1" "UIDPLUS"; 
    server {
        protocol    imap;
        listen      143;
        starttls    on;
    }
    server {
        protocol    imap;
        listen      993;
        ssl     on;
    }
    pop3_capabilities  "TOP" "USER";
    server {
        protocol    pop3;
        listen      110;
        starttls    on;
        pop3_auth   plain;
    }
    server {
        protocol    pop3;
        listen      995;
        ssl     on;
        pop3_auth   plain;
    }
}
share|improve this question

3 Answers 3

Someone has been working on a branch which implements SSL backend support, I believe it is still experimental and is built against 1.0.11 but it should be at least one to watch: https://github.com/druga/unuzbl/tree/master/nginx-temp

share|improve this answer
    
Accepted as "No, and not anytime soon." This is not a branch to watch, "Written in hackish style, without styling, not for upstream tree for sure." –  84104 May 31 '12 at 20:27
    
This is not a branch to watch, "Written in hackish style, without styling, not for upstream tree for sure." -- Who cares the code style till project works. –  user123582 Jun 5 '12 at 9:45

Could this link be of any help:

I think it answers a few of your questions: http://wiki.nginx.org/MailSslModule

share|improve this answer
    
Not without further explanation. I have spent some time looking at that page and you can see I have used more than a few of its directives. However, they only seem to effect acceptable forms in commutation between the client and the proxy, not the proxy and the backend servers. –  84104 May 9 '12 at 16:09

Not really an answer to your question but it may help future readers like me.

Perdition is another mail proxy that is able to handle both plain-text and SSL/TLS encrypted connections.

A quick presentation of both nginx and perdition: http://fr.slideshare.net/jpmens/the-perdition-and-nginx-imap-proxies

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.