Martin Waschbuesch wrote:
Hi all,
I successfully installed the qmailtoaster and am very happy so far. Now,
I have a few questions that I need some help with. So if anyone knows
how to do this or can point me to good documentation I would really
appreciate the help.
I have installed a SSL certificate and got it working for apache,
courier and qmail. Now, is it possible to enforce use of encryption for
IMAP, POP3 and SMTP for everyone not on localhost - e.g. it would be
silly to have horde/imp (installed on same server) to use STMP or IMAP
over ssl, but everyone not working on webmail should have to.
For IMAP and POP3, simply stop the services. For SMTP, it's not that
simple, and I don't know off hand.
Also, how would I go about enforcing the management webpages (qcontrol
et al) and the webmail (I use horde instead of squirrel) to only use
https? right now I can access them in both ways and I would like any
attempt to access those sites without encryption to jump to https://xyz
instead.
This is done using apache's rewrite module. First, be sure it's loaded:
/etc/httpd/conf/httpd.conf:
LoadModule rewrite_module modules/mod_rewrite.so
Then add the rewrite instructions to the appropriate conf files, e.g.:
/etc/httpd/conf/squirrelmail.conf:
RewriteEngine on
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*/webmail.*)$ https://%{SERVER_NAME}$1 [L,R]
<Directory /usr/share/squirrelmail>
Options None
Order allow,deny
allow from all
SSLRequireSSL
</Directory>
I would like everyone of my roaming users to always use the submission
port 587 (and ssl). Can that be enforced, too?
Not that I'm aware of. While spamdyke does TLS and authentication, it
doesn't appear to have an option to require TLS when authenticating.
I've just posted a request for this feature on the spamdyke list. We'll
see what Sam (the author) has to say about it.
There may be some other way I'm not aware of. Jake would probably know
for sure.
Thanks a lot for the help!
Sure. Now it's your turn Martin. Will you please update the wiki with
all of this when you're done? I'd like to see a new page under
Configuration/Security that ties all of this stuff together. Are you up
for it?
--
-Eric 'shubes'
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
