How can I allow local pop3 but enforce remote pop3s on my ubuntu/postfix/dovecot OS/MTA/MDA

Question

I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for smtp using the postfix directive:

smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination

The most suitible functionality I can find in Dovecot is to force all clients to use secure authentication with the disable_plaintext_auth = yes directive.

As a workaround I can set disable_plaintext_auth = no and add lines to my firewall using iptables to allow specific port access like so:

sudo iptables -A INPUT -i eth0 -p tcp -s 192.168.0.0/24 --dport 143 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 993 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp -s 192.168.0.0/24 --dport 110 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 995 -j ACCEPT

But this seems rather hacky and introduces more issues for example: This wont allow STARTTLS over port 110 from a remote client.

Is there another way to allow local clients to authenticate with my postfix/dovecot system over either a secure or insecure connection while still forcing remote clients to only use a secure authentication?

Answer 1

You don't want to send passwords over cleartext regardless of whether that's a local or non-local user. It's just bad practice and arguments of the "but it's only traversing my trusted switch" kind inevitably lead into a pitfall. You'll make a mistake, or someone else will make a mistake, and suddenly you'll find out months later that somehow attackers were able to sniff your CEO's account password and leak confidential emails to your competitors. Just don't do it.

Besides, part of your premise is incorrect. What postfix is doing via permit_mynetworks is not the same as what cleartext imap would be doing. This configuration option instructs postfix to accept messages for relaying from any local network without requiring authentication -- so no passwords will traverse the unencrypted connection. However, if you allow local clients to talk directly to imap or pop3, that will send passwords in cleartext over the network. Otherwise how would the imap server distinguish user bob from user alice.

If your concern is the overhead of encryption, then it's really not something to worry about these days. AES is really fast, especially if you're using a system with AES-NI support in the processor (and a relatively recent OS that makes use of that in openssl). The performance hit is not worth the headaches of worrying about your users' passwords traversing the network in unencrypted form.