6

Can Nginx be an mail proxy for a backend server that does not accept cleartext logins?

Preferably I'd like to know what directive to include so that it will invoke STARTTLS/STLS, but communication via IMAPS or POP3S is sufficient.

relevant(?) section of nginx.conf

mail {
    auth_http           localhost:80/mailproxy/auth.php;
    proxy               on; 
    ssl_prefer_server_ciphers   on;
    ssl_protocols           TLSv1 SSLv3;
    ssl_ciphers         HIGH:!ADH:!MD5:@STRENGTH;
    ssl_session_cache       shared:TLSSL:16m;
    ssl_session_timeout     10m;
    ssl_certificate         /etc/ssl/private/hostname.crt;
    ssl_certificate_key     /etc/ssl/private/hostname.key;
    imap_capabilities  "IMAP4rev1" "UIDPLUS"; 
    server {
        protocol    imap;
        listen      143;
        starttls    on;
    }
    server {
        protocol    imap;
        listen      993;
        ssl     on;
    }
    pop3_capabilities  "TOP" "USER";
    server {
        protocol    pop3;
        listen      110;
        starttls    on;
        pop3_auth   plain;
    }
    server {
        protocol    pop3;
        listen      995;
        ssl     on;
        pop3_auth   plain;
    }
}
Improve this question

4 Answers 4

Reset to default
4

You can just use the stunnel service in client mode to listen for unencrypted traffic at localhost and then pass it on to the SSL backend.

Example configuration:

[gmail-pop3]
client = yes
accept = 127.0.0.1:1110
connect = pop.gmail.com:995

Then point nginx to localhost:1110 as backend and it will in fact connect to GMail's POP3 server over SSL.

Improve this answer
2
  • This will work. However, it does require setting up an entry for each different backend server. It also requires minor additions to the auth script so as to return the local port, rather than the remote one.
    – 84104
    Commented Sep 4, 2014 at 17:34
  • @84104 yes, this solution may not be feasible if you have really many backend servers
    – Spc_555
    Commented Sep 4, 2014 at 17:37
2

Not really an answer to your question but it may help future readers like me.

Perdition is another mail proxy that is able to handle both plain-text and SSL/TLS encrypted connections.

A quick presentation of both nginx and perdition: http://fr.slideshare.net/jpmens/the-perdition-and-nginx-imap-proxies

Improve this answer
1

Someone has been working on a branch which implements SSL backend support, I believe it is still experimental and is built against 1.0.11 but it should be at least one to watch: https://github.com/druga/unuzbl/tree/master/nginx-temp

Improve this answer
2
  • 1
    Accepted as "No, and not anytime soon." This is not a branch to watch, "Written in hackish style, without styling, not for upstream tree for sure."
    – 84104
    Commented May 31, 2012 at 20:27
  • This is not a branch to watch, "Written in hackish style, without styling, not for upstream tree for sure." -- Who cares the code style till project works.
    – user123582
    Commented Jun 5, 2012 at 9:45
0

Could this link be of any help:

I think it answers a few of your questions: http://wiki.nginx.org/MailSslModule

Improve this answer
1
  • Not without further explanation. I have spent some time looking at that page and you can see I have used more than a few of its directives. However, they only seem to effect acceptable forms in commutation between the client and the proxy, not the proxy and the backend servers.
    – 84104
    Commented May 9, 2012 at 16:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .