Use perdition as ssl offload proxy for imap / pop and managesieve

 In modern setups you often have an ingress controller, which does the ssl termination of the connections and then routes the traffic to the correct backend(s)

For kubernetes and http(s), often nginx is used for that task.

When you wish to do the same for imap and/or pop, then it also possible to use nginx for this.

https://docs.nginx.com/nginx/admin-guide/mail-proxy/mail-proxy/

But the main drawback is, that you need to implement some authentication and routing based on an http request.Also the managesieve protocol isn't supported.

If you don't wish to do the hassle with this, or you haven't the required infos to do it, then perdition can handle this be used as a full imap/pop/managesieve proxy.

The basic setup is quite simple, but has a few things to be aware of, when using it with ssl and/or ipv6.

When you enable ssl, then you have to specify the certificate files.

Usually something like this:

ssl_ca_file /etc/postfix/ssl/ssl-root.ca
ssl_cert_file /etc/postfix/ssl/myserver.crt
ssl_key_file /etc/postfix/ssl/myserver.key

When you then start perdition, it will probably log some warning about not beeing able to read the DH parameters from the certificate file. 

could not read DH params from cert file

Modern OpenSSL configurations require Diffie-Hellman values to generate secure keys in the exchange.

If your certificate does not have these embedded in it, you can generate them yourself and add them to the certificate.

openssl dhparam -out dhparams.pem 4096

Then just append the content of the dhparams.pem file to your .crt file and perdition has the required DH values.

The second thing you might struggle with, when you start perdition on an IPv6 enable host, then perdition will only bind the IPv4 address and not to the IPv6 address.

Unfortunally the documentation is lacking in this area, as how to bind the IPv6 ports too.

The correct syntax is to use this in the perdition.imap4s etc. files:

bind_address 88.xx.xx.xx,"[2a01:xxx:xxx:xxx::xxx]"

Please note that you must specify both IPvç and IPv6 addresses, and also that the IPv6 "[::]" will not work.

You have to specify the IPv6 address and enclose it in "[...]", including the " characters.

Configuring perdition as managesieve proxy is also not very well documented.

Specifying the sieve capabilities is rather tricky, here a wroking example:

capability \
"\"IMPLEMENTATION\" \"Cyrus timsieved\"  "\
"\"SIEVE\" \"comparator-i;octet "\
"comparator-i;ascii-numeric "\
"fileinto "\
"reject "\
"vacation "\
"imapflags "\
"notify "\
"envelope "\
"relational "\
"regex "\
"subaddress "\
"copy\"  "\
"\"SASL\" \"PLAIN\""

 

The important things to note in this:

Use \" to delimit the capabilities, and use two spaces to delimit the capability lines .

Have a look at the base config file perdition.conf as a staring point

If you have clients using K9 mail (And probably other too), then you might remove all "AUTH=..." settings from the imap capability string.

https://lists.vergenet.net/pipermail/perdition-users/2011-August/002547.html

Please also see my upcomming post  on monitoring perdition with Zabbix

ipv6 in the wild

In the last year we did many steps toward ipv6 enabling our networks and servers.
Many things are simple, but there are also many pitfalls.

Here some infos about ipv6 in Ubuntu/Debian

- The Ubuntu distribution 9.04 and newer have good IPv6 support, most applications work with ipv4 and ipv6. Some applications however have problems with ipv6 addresses in some places. Here a upgrade to the most recent 10.10 release solves many issues.

- Debian, yeah, most things work fine in lenny, you can do most things you need, but there are still a few places where you may stumble. The real "full" ipv6 support is coming up in squeeze.

Here a two places where you might struggle:

- Assigning a static IPv6 address in debian lenny just does not work....
Nothing to worry about on workstations/desktops, but on firewalls and servers... it would be nice to always have the same ipv6 address assigned.
The reason for the problem is, that when the eth0 interface (or any other) is activated, the kernel module ipv6 is not yet loaded. So it's not possible to assign the ipv6 settings specified in the /etc/network/interfaces file.
The simplest solution is to just add ipv6 to the file /etc/modules (and rebuild the initramfs), that way ipv6 is directly loaded on boot and everything works as intended.

- RSYNC has only partial ipv6 support.
What does this mean ?
Rsync is able to resolve host names into ipv6 addresses and then connect to them via ipv6.
But if you with to specify the ipv6 address of the host directly on the commandline, then it fails parsing the address.
The simplest way to solve the problem is to install the rsync from the debian backports.

Don't forget, ipv4 addresses are running out in the next year, so prepare slowly to add ipv6 support to your network.
You don't have to do it in a big-bang way, rather just implement it step-by-step.