POP3/IMAP Stronger Authentication

Question

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have been assigned new tokens are also pop3/imap users from long while ago. We then noticed that while web application are well protected by 2FA , mail applications is an easy way to bypass any stronger authentication method because POP3/IMAP don't support 2FA.

My question is how can i provide a stronger authentication method with pop3/imap services that doesn't support 2FA? Any advice in order to address this issue?

Answer 1

If your IMAP server supports using PAM for authentication, you might be able to configure PAM to use a Yubikey + a password for two-factor authentication. I believe the Yubikey does support integration with PAM, though I have no personal experience with it and I have not seen any reports of how to integrate it with an IMAP server.

Or, you could use Gmail as your mail provider, and use an "application-specific password" to authenticate to Gmail. This is technically not two-factor authentication, but it's somewhat better than a user-chosen password.

Answer 2

IMAPS (aka "IMAP within SSL") can be configured with a requirement for a client certificate (that's bi-authenticated SSL). You could setup the IMAPS server that way, and request certificates issued by a custom CA and distributed in smartcards (or smartcard-equivalent USB tokens, which is easier since these do not need specific readers). Finally, the smartcards could require a PIN code, which then counts as 2FA (one factor is possession of the smartcard, second factor is knowledge of the PIN).

Unfortunately, not all IMAPS clients support client certificates (e.g., on an iPhone, it apparently requires jailbreaking and some extra effort)(good luck on plugging a smartcard in an iPhone anyway...). Also, setting up a PKI and enrolling smartcards, that tends to be, let's say, a bit expensive.

Answer 3

While it would be relatively simple to modify an open-source POP/IMPA server to use a different authentication method, re-writing MS Outlook is going to be a lot more difficult.

Alternatively you could use a reverse captive gateway to only allow access to the POP/IMPA server for IP addresses which have recently, successfully authenticated via HTTP - but there are a number of issues with this:

• you are basing authentication on an IP address - not the user - there may be other users at the IP address

• the client IP you see serverside may be different for different protocols / same client

A more practical solution would be to restrict IMAP/POP access to a VPN and require authentication for the VPN (first factor) along with a POP username/password (second factor).

Answer 4

You could only allow connections to the mail server from internal IPs and provide a VPN and webmail solution. The VPN would be necessary for using clients like Outlook and would require two factor authentication on connection. The webmail option would require two factor authentication to connect to the site and the site would allow for sending and receiving e-mail via an internal server which is allowed access by the mail server's rules.

Answer 5

Tom Leek's recommendation to look into client certs is your best bet. One-time password solutions are a poor fit for IMAP, because many email clients open multiple connections or repeated connections without it being apparent to the user.

I logged into my webmail IMAP client once this morning, but looking at the logs I see it has performed authentication against the IMAP backend 40 times in the last 90 minutes. If a one-time password factor was in use, that could not be done without additional prompting.