Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have been assigned new tokens are also pop3/imap users from long while ago. We then noticed that while web application are well protected by 2FA , mail applications is an easy way to bypass any stronger authentication method because POP3/IMAP don't support 2FA.

My question is how can i provide a stronger authentication method with pop3/imap services that doesn't support 2FA? Any advice in order to address this issue?

share|improve this question
add comment

6 Answers 6

IMAPS (aka "IMAP within SSL") can be configured with a requirement for a client certificate (that's bi-authenticated SSL). You could setup the IMAPS server that way, and request certificates issued by a custom CA and distributed in smartcards (or smartcard-equivalent USB tokens, which is easier since these do not need specific readers). Finally, the smartcards could require a PIN code, which then counts as 2FA (one factor is possession of the smartcard, second factor is knowledge of the PIN).

Unfortunately, not all IMAPS clients support client certificates (e.g., on an iPhone, it apparently requires jailbreaking and some extra effort)(good luck on plugging a smartcard in an iPhone anyway...). Also, setting up a PKI and enrolling smartcards, that tends to be, let's say, a bit expensive.

share|improve this answer
add comment

If your IMAP server supports using PAM for authentication, you might be able to configure PAM to use a Yubikey + a password for two-factor authentication. I believe the Yubikey does support integration with PAM, though I have no personal experience with it and I have not seen any reports of how to integrate it with an IMAP server.

Or, you could use Gmail as your mail provider, and use an "application-specific password" to authenticate to Gmail. This is technically not two-factor authentication, but it's somewhat better than a user-chosen password.

share|improve this answer
add comment

While it would be relatively simple to modify an open-source POP/IMPA server to use a different authentication method, re-writing MS Outlook is going to be a lot more difficult.

Alternatively you could use a reverse captive gateway to only allow access to the POP/IMPA server for IP addresses which have recently, successfully authenticated via HTTP - but there are a number of issues with this:

  • you are basing authentication on an IP address - not the user - there may be other users at the IP address

  • the client IP you see serverside may be different for different protocols / same client

A more practical solution would be to restrict IMAP/POP access to a VPN and require authentication for the VPN (first factor) along with a POP username/password (second factor).

share|improve this answer
add comment

You could only allow connections to the mail server from internal IPs and provide a VPN and webmail solution. The VPN would be necessary for using clients like Outlook and would require two factor authentication on connection. The webmail option would require two factor authentication to connect to the site and the site would allow for sending and receiving e-mail via an internal server which is allowed access by the mail server's rules.

share|improve this answer
add comment

Tom Leek's recommendation to look into client certs is your best bet. One-time password solutions are a poor fit for IMAP, because many email clients open multiple connections or repeated connections without it being apparent to the user.

I logged into my webmail IMAP client once this morning, but looking at the logs I see it has performed authentication against the IMAP backend 40 times in the last 90 minutes. If a one-time password factor was in use, that could not be done without additional prompting.

share|improve this answer
add comment

The first thing is to reframe your question: What standard authentication protocols can I use to implement two-factor authentication in IMAP? The answer inside the firewall is usually radius. If you can configure your IMAP server to support radius and session caching (to avoid the issue @gowenfawr mentions as you have no doubt also done for your web apps) you can get it working with any 2FA vendor. As we all support RADIUS.

I'm not sure how to do this one Windows, but most likely you will need something in front of your IMAP server like Forefront. Here's how I did it for SquirrelMail/IMAP on Linux: https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-webmail-for-wikid-strong-authentication.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.