We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have been assigned new tokens are also pop3/imap users from long while ago. We then noticed that while web application are well protected by 2FA , mail applications is an easy way to bypass any stronger authentication method because POP3/IMAP don't support 2FA.

My question is how can i provide a stronger authentication method with pop3/imap services that doesn't support 2FA? Any advice in order to address this issue?


IMAPS (aka "IMAP within SSL") can be configured with a requirement for a client certificate (that's bi-authenticated SSL). You could setup the IMAPS server that way, and request certificates issued by a custom CA and distributed in smartcards (or smartcard-equivalent USB tokens, which is easier since these do not need specific readers). Finally, the smartcards could require a PIN code, which then counts as 2FA (one factor is possession of the smartcard, second factor is knowledge of the PIN).

Unfortunately, not all IMAPS clients support client certificates (e.g., on an iPhone, it apparently requires jailbreaking and some extra effort)(good luck on plugging a smartcard in an iPhone anyway...). Also, setting up a PKI and enrolling smartcards, that tends to be, let's say, a bit expensive.

  • For an example of server which supports this, courier-imap-ssl, for an example of client for testing, Mozilla Thunderbird. Jan 26 '17 at 4:14

If your IMAP server supports using PAM for authentication, you might be able to configure PAM to use a Yubikey + a password for two-factor authentication. I believe the Yubikey does support integration with PAM, though I have no personal experience with it and I have not seen any reports of how to integrate it with an IMAP server.

Or, you could use Gmail as your mail provider, and use an "application-specific password" to authenticate to Gmail. This is technically not two-factor authentication, but it's somewhat better than a user-chosen password.


You could only allow connections to the mail server from internal IPs and provide a VPN and webmail solution. The VPN would be necessary for using clients like Outlook and would require two factor authentication on connection. The webmail option would require two factor authentication to connect to the site and the site would allow for sending and receiving e-mail via an internal server which is allowed access by the mail server's rules.


While it would be relatively simple to modify an open-source POP/IMPA server to use a different authentication method, re-writing MS Outlook is going to be a lot more difficult.

Alternatively you could use a reverse captive gateway to only allow access to the POP/IMAP server for IP addresses which have recently, successfully authenticated via HTTP - but there are a number of issues with this:

  • you are basing authentication on an IP address - not the user - there may be other users at the IP address

  • the client IP you see serverside may be different for different protocols / same client

A more practical solution would be to restrict IMAP/POP access to a VPN and require authentication for the VPN (first factor) along with a POP username/password (second factor).

  • I think that the multifactor authentication idea is to use different kinds of authentication, e.g. password (what you known), OTP (what you have). Jan 25 '17 at 16:50
  • @Jaime: read the thread again. The OP has a second factor which is not going to work with his existing mail service. But it might be pissible to apply it to control connectivity to the service (and therefore to other protocols without having to rely on custom software).
    – symcbean
    Jan 25 '17 at 22:39

Tom Leek's recommendation to look into client certs is your best bet. One-time password solutions are a poor fit for IMAP, because many email clients open multiple connections or repeated connections without it being apparent to the user.

I logged into my webmail IMAP client once this morning, but looking at the logs I see it has performed authentication against the IMAP backend 40 times in the last 90 minutes. If a one-time password factor was in use, that could not be done without additional prompting.


The first thing is to reframe your question: What standard authentication protocols can I use to implement two-factor authentication in IMAP? The answer inside the firewall is usually radius. If you can configure your IMAP server to support radius and session caching (to avoid the issue @gowenfawr mentions as you have no doubt also done for your web apps) you can get it working with any 2FA vendor. As we all support RADIUS.

I'm not sure how to do this one Windows, but most likely you will need something in front of your IMAP server like Forefront. Here's how I did it for SquirrelMail/IMAP on Linux: https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-webmail-for-wikid-strong-authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.