IMAP/SMTP with client-certificate?

[mholti]

Hi,
i just installed the iOS Mail Push Support (thanks to @reneploetz, it works like a charm).

Now i have to open the IMAP and SMTP-Ports to the internet. So i can get rid of z-push...

But: a password-protection isn't what i want. I'm running DMS behind traefik as proxy.
Has anyone managed to protect IMAP and SMTP with client-certificates?
(Since z-push uses https, it's no problem there)

Michael

[reneploetz]

I'm not using this kind of configuration but I can give you some (untested) and probably incomplete hints, albeit the exact settings depend on what you actually want to achieve. Do you want them as second factor or remove passwords altogether?

Without knowing the complexity of your usecase it's hard to tell what you want to achieve ;)

Traefik

• You probably need to configure TLS passthrough because there is no setting to forward the client certificate from traefik over TCP otherwise as far I read their documentation.

Postfix

• You need to modify the master.cf for ports (587 and/or 465) where you want to enable this.
• Decide on how to validate the certificates - you can choose between permit_tls_all_clientcerts, permit_tls_clientcerts and check_ccert_access - you really really want to consult the documentation here, e.g. https://www.postfix.org/postconf.5.html#permit_tls_clientcerts

Again, without knowing your usecases, .... I would go for permit_tls_clientcerts as it's more secure than permit_tls_all_clientcerts and less complex than check_ccert_access:

• Configure the following settings in master.cf with -o options:

smtpd_client_restrictions    = permit_mynetworks, permit_tls_clientcerts, reject
smtpd_relay_restrictions     = …, permit_tls_clientcerts, …
smtpd_recipient_restrictions = …, permit_tls_clientcerts, …
smtpd_tls_ask_ccert          = yes

• You might want to remove all smtpd_sasl_* and permit_sasl_authenticated settings if you plan to only use client certificates.

• Use this in main.cf:
  relay_clientcerts = hash:/etc/postfix/relay_clientcerts

• Create the relay_clientcerts file with the sha256 of the public keys of the client certificates you want to use like so (and hash it using postmap):
  71:4C:..more-sha256..:A7:12 OK (see also: https://www.postfix.org/postconf.5.html#smtpd_tls_fingerprint_digest)

Dovecot

• Documentation here: https://doc.dovecot.org/configuration_manual/dovecot_ssl_configuration/#client-certificate-verification-authentication
• Modify /etc/dovecot/conf.d/10-ssl.conf

ssl_ca = your/trusted/ca/file
ssl_verify_client_cert = yes
auth_ssl_require_client_cert = yes
auth_ssl_username_from_cert = yes

This will use the username that was provided in the CN field. You can also opt for another field using ssl_cert_username_field, e.g. ssl_cert_username_field=emailAddress

If you want to disable password checking completely, you have to use a custom passdb. This is not recommended by Dovecot tough.

• Modify /etc/dovecot/conf.d/10-auth.conf

auth_mechanisms = external

Note that you may want to use auth_mechanisms = plain login external if you want to use other logins. The whole idea is to use external as a way to use a fixed user database with empty passwords:

• Create a new fixed password file /etc/dovecot/users-external

user1@example.com:::::::
user2@example.com:::::::

• Create a new passdb entry in /etc/dovecot/auth-passwdfile.inc

passdb {
  driver = passwd-file
  args = scheme=PLAIN username_format=%u /etc/dovecot/users-external
  mechanisms = external
  override_fields = nopassword
}

Note that you probably want to remove the old passdb if not needed.

[mholti]

Hi,
thanks for this detaild answer. I'll setup an test-environment cause i don't want to mess around with my prod-DMS.
I'll report my results as soo as they are there ;-)

Michael