I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for smtp using the postfix directive:

smtpd_recipient_restrictions =

The most suitible functionality I can find in Dovecot is to force all clients to use secure authentication with the disable_plaintext_auth = yes directive.

As a workaround I can set disable_plaintext_auth = no and add lines to my firewall using iptables to allow specific port access like so:

sudo iptables -A INPUT -i eth0 -p tcp -s --dport 143 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 993 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp -s --dport 110 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 995 -j ACCEPT

But this seems rather hacky and introduces more issues for example: This wont allow STARTTLS over port 110 from a remote client.

Is there another way to allow local clients to authenticate with my postfix/dovecot system over either a secure or insecure connection while still forcing remote clients to only use a secure authentication?


You don't want to send passwords over cleartext regardless of whether that's a local or non-local user. It's just bad practice and arguments of the "but it's only traversing my trusted switch" kind inevitably lead into a pitfall. You'll make a mistake, or someone else will make a mistake, and suddenly you'll find out months later that somehow attackers were able to sniff your CEO's account password and leak confidential emails to your competitors. Just don't do it.

Besides, part of your premise is incorrect. What postfix is doing via permit_mynetworks is not the same as what cleartext imap would be doing. This configuration option instructs postfix to accept messages for relaying from any local network without requiring authentication -- so no passwords will traverse the unencrypted connection. However, if you allow local clients to talk directly to imap or pop3, that will send passwords in cleartext over the network. Otherwise how would the imap server distinguish user bob from user alice.

If your concern is the overhead of encryption, then it's really not something to worry about these days. AES is really fast, especially if you're using a system with AES-NI support in the processor (and a relatively recent OS that makes use of that in openssl). The performance hit is not worth the headaches of worrying about your users' passwords traversing the network in unencrypted form.

  • Good call about my premise. I hadnt realised: permit_mynetworks allows relaying messages in cleartext but I'm asking to transmit passwords in cleartext.
    – Mr Purple
    Apr 10 '13 at 20:40
  • Sorry I meant permit_mynetworks allows relaying messages without authentication whereas I'm requesting a method to send passwords in cleartext. I see now they are two very different things. The reason I asked was to try and make it as easy as possible for local users to configure clients, and in case there are some clients in my local network which cant go secure for whatever reason. After reviewing your advice it would seem that forcing all users to use a client capable of interfacing with my secure authentication is the way to go. Also, I can't actually think of any insecure clients anyway.
    – Mr Purple
    Apr 10 '13 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.