Force TLS authentication by SMTP - Plesk with submission

adrik · Unread post by **adrik** » Sun Mar 09, 2008 1:01 pm

Hello,

I am using PLESK 8.3 with "Enable message submission" ON and Set "Relaying" to CLOSED. Everything works just fine, but I want to force my SMTP users to use TLS encryption only and block them using just simple PLAIN authentification. I read about setting FORCE_TLS=1 on some QMAIL sites (http://qmail.jms1.net/), but I am not sure where to set it, not to conflict with PLESK.

Thank you.

Adrik

Unread post by **scott** » Mon Mar 10, 2008 9:27 am

There might be a way to pass an environment variable like that through xinetd. Id start googling around for xinetd and qmail

adrik · Unread post by **adrik** » Mon Mar 10, 2008 12:09 pm

Hello scott,

I have already tried this, but without effect.

Code: Select all

service submission
{
        socket_type     = stream
        protocol        = tcp
        wait            = no
        disable         = no
        user            = qmaild
        instances       = UNLIMITED
        env             = SUBMISSION=1 SMTPAUTH=1 FORCE_TLS=1
        server          = /var/qmail/bin/tcp-env
        server_args     = -Rt0 /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/
qmail/bin/true
}

It looks like xinetd is ignoring this setting

Adrik

Unread post by **scott** » Mon Mar 10, 2008 1:47 pm

It might be that the PSA implementation of qmail doesn't support those flags too.

breun · Unread post by **breun** » Mon Mar 10, 2008 2:37 pm

Yeah, you'll probably need to build your own qmail with the patch on that page you linked to. If you want to go that route check out http://kb.swsoft.com/en/1161

Unread post by **scott** » Mon Mar 10, 2008 3:29 pm

You know that could be in the smtp_auth piece, take a look at /etc/xinetd.d/submission_psa

service submission
{
disable = no
socket_type = stream
protocol = tcp
wait = no
user = qmaild
instances = UNLIMITED
env = SUBMISSION=1 SMTPAUTH=1
server = /var/qmail/bin/tcp-env
server_args = -Rt0 /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true
}

And for your diet-coke way of "forcing TLS".. do that to smtps_psa, and just make everyone use port 465.

adrik · Unread post by **adrik** » Tue Mar 11, 2008 6:30 am

Thank you,

till now I did not find the solution.

My goal is to allow only encrypted authorization methods for SMTP. No encrypted authorization should be blocked. (LOGIN, PLAIN). Doesnt matter if it is SSL or TLS.

I have already tried it with SSL, but I did not find the solution as well. I can allow SMTP authorisation in Plesk by setting Relay options to : "authorization is required - SMTP". SSL ist working fine, but the PLAIN authorisation is working also. I dont like it, if anybody can see the password with nmap. Anyway, most of my clients are using the same password form mail/ftp/ssh.

Adrik

Unread post by **scott** » Tue Mar 11, 2008 10:46 am

Assuming they're hitting the SSL SMTP port (465), the entire session is encrypted. With 25 and 587, as soon as they issue the STARTTLS command the session would also be encrypted.

Provided your users are hitting 465, then intercepting the users password will not be an issue. You should also ensure that your imap/pop connections are also using the SSL ports (993 and 995 respectively), and that your certificates on SMTP and IMAP/SSL are not using the plesk defaults.

adrik · Unread post by **adrik** » Tue Mar 11, 2008 11:06 am

Hello Scott,

thank you for your information. The SSL is working for me fine, exactly as you write. That is no problem for me. The problem is that my user can still use PLAIN (NO TLS) configuration to authentificate with SMTP for relaying using port 25. Of course they can use also TLS (25) and SSL (465). That is OK for me. My object is to DISABLE "No TLS" (PLAIN) SMTP authentification for relaying on port 25 and force my user to set the mail client accordingly to use TLS (25) or SSL (465) with SMTP. Any idea how can I do it?

I dont have the problem to block my users using POP3 and IMAP. I can let the Plesk config as it is and simple block the ports with firewall accordingly. Then they are forced to config their mail clients to use POP3S and IMAPS accordingly.

Thank you.

Adrik

Unread post by **scott** » Tue Mar 11, 2008 4:00 pm

Lots, all of them involve hacking away at your qmail implementation, or using tcpserver.