[imp] IMAP and Security issues

[Joseph Brennan]

> First, can IMP speak imap-ssl?  I'm not sure it should need to...

It needs to, except where it talks to localhost or possibly where
it talks to an imap host in the same machine room.


   I was thinking that at least an imap-ssl server
> would be a better option, so I thought I'd see what folks here were
> doing.   [ . . .  ]
I could  probably keep a non-ssl IMAP server
> for localhost use and have a public  imap-ssl server, correct?  I'm
> just worried that would cause consistency  problems.  *sigh*

The current U Wash imap server can be compiled with ssl, and the
same binary is an ssl and non-ssl imap server.  We do this.


> I'm in the unfortunate situation that I can't necessarily trust the
> integrity  of the network that my server sits on and thus do care
> about sniffing.  That's  the attraction to the imap-ssl option.

Common situation at a university.  We want IMP SSL so we can let
our IMP host connect safely to certain other IMAP servers within the
university but not in the same machine room; one is located at
another campus.  It was good hearing SSL will work with 2.3.



Joseph Brennan                           postmaster@columbia.edu
Academic Technologies Group, Academic Information Systems (AcIS)