dovecot - Nov 2018 - different TLS protocols on different ports

Am 14.11.18 um 20:22 schrieb Aki Tuomi:
> Not possible I'm afraid.
Hello Aki,

is it not possible in 2.2.36 or not possible at all?

I stumbled upon RFC 8314 *) and I found it a welcome option to enforce more
modern protocols/ciphers.
IMAPS/SUBMISSIONS aren't used widely (at least to my knowlege, many
postmaster used to configure IMAP+SUBMISSION and STARTTLS)
Switching Clients to complete new ports is a chance to separate and dry out
legacy MUA's

I just tried this but that's no valid syntax tough:

	service imap-login {
	  inet_listener imap {
	    port = 143
            # using default protocols and ciphers...
	  }
	  inet_listener imaps {
	    port = 993
	    ssl_protocols = TLSv1.2 TLSv1.3
            ssl_cipher_list = ...
            
	  }
	}


Postfix let me easily define different TLS protocols on different ports.
For that it would be cool if dovecot could assist on such migrations, too.

Andreas

*) see https://tools.ietf.org/html/rfc8314
   as well as the draft
https://tools.ietf.org/html/draft-lvelvindron-tls-for-email-02 to deprecate
TLSv1.1

> On November 14, 2018 at 12:46 PM "A. Schulze" <sca at
andreasschulze.de> wrote:
<
> I stumbled upon RFC 8314 *) and I found it a welcome option to enforce more
modern protocols/ciphers.
> IMAPS/SUBMISSIONS aren't used widely (at least to my knowlege, many
postmaster used to configure IMAP+SUBMISSION and STARTTLS)
"IMAPS" has been used forever.  Every installation I can think of
supports 993.

Same with submission.  465/587 has been a standard port for awhile now.

In fact, these are the only ports someone like a Google will allow you to
connect to.
https://support.google.com/mail/answer/7126229?hl=en

> Switching Clients to complete new ports is a chance to separate and dry out
legacy MUA's
There is no switch to do.  These ports are well-known and well used.

> I just tried this but that's no valid syntax tough:
> 
> 	service imap-login {
> 	  inet_listener imap {
> 	    port = 143
>             # using default protocols and ciphers...
> 	  }
> 	  inet_listener imaps {
> 	    port = 993
> 	    ssl_protocols = TLSv1.2 TLSv1.3
>             ssl_cipher_list = ...
>             
> 	  }
> 	}
> 
> 
> Postfix let me easily define different TLS protocols on different ports.
> For that it would be cool if dovecot could assist on such migrations, too.
> 
> Andreas
> 
> *) see https://tools.ietf.org/html/rfc8314
>    as well as the draft
https://tools.ietf.org/html/draft-lvelvindron-tls-for-email-02 to deprecate
TLSv1.1

Am 14.11.18 um 21:21 schrieb Michael Slusarz:
> These ports are well-known and well used.
OK, to be clear: they're not in /my/ networks :-)