Instalar un servidor de e-mail que soporte el protocolo IMAPS.

root@server:~# aptitude install dovecot-imapd

Toda la configuración está almacenada en el archivo /etc/dovecot/dovecot.conf.

Luego de la instalación de dovecot, se necesita indicar cuáles son los protocoles que se pretenden activar en el archivo de configuración. En este caso, los protocolos IMAP e IMAPS:

/etc/dovecot/dovecot.conf

# [...]

# Protocols we want to be serving: imap imaps pop3 pop3s managesieve
# If you only want to use dovecot-auth, you can set this to "none".
#protocols = imap imaps
protocols = imap imaps

# [...]

El servidor de e-mail dovecot sólo acepta conexiones encriptadas vía TLS (Transport Layer Security) o SSL (Secure Sockets Layer). Ambos requieren certificados digitales.

Los certificados SSL para dovecot son generados automáticamente durante la instalación. Sin embargo, podemos utilizar los Certificados ssl Auto-firmados que se generaron previamente:

/etc/dovecot/dovecot.conf

# [...]

##
## SSL settings
##

# IP or host address where to listen in for SSL connections. Remember to also
# add imaps and/or pop3s to protocols setting. Defaults to same as "listen"
# setting if not specified.
#ssl_listen =

# SSL/TLS support: yes, no, required. </usr/share/doc/dovecot-common/wiki/SSL.txt>
#ssl = yes

# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
# dropping root privileges, so keep the key file unreadable by anyone but
# root.
#ssl_cert_file = /etc/ssl/certs/dovecot.pem
#ssl_key_file = /etc/ssl/private/dovecot.pem

ssl_cert_file = /etc/ssl/certs/server.crt
ssl_key_file = /etc/ssl/private/server.key.insecure

# If key file is password protected, give the password here. Alternatively
# give it when starting dovecot with -p parameter. Since this file is often
# world-readable, you may want to place this setting instead to a different
# root owned 0600 file by using !include_try <path>.
#ssl_key_password =

# [...]

La localización de los buzones de correo debe indicarse también, para evitar ambigüedades. En este caso se encuentran en un sub-directorio del directorio home de cada usuario llamada “Maildir”:

/etc/dovecot/dovecot.conf

# [...]

##
## Mailbox locations and namespaces
##

# Location for users' mailboxes. This is the same as the old default_mail_env
# setting. The default is empty, which means that Dovecot tries to find the
# mailboxes automatically. This won't work if the user doesn't have any mail
# yet, so you should explicitly tell Dovecot the full location.
#
# If you're using mbox, giving a path to the INBOX file (eg. /var/mail/%u)
# isn't enough. You'll also need to tell Dovecot where the other mailboxes are
# kept. This is called the "root mail directory", and it must be the first
# path given in the mail_location setting.
#
# There are a few special variables you can use, eg.:
#
#   %u - username
#   %n - user part in user@domain, same as %u if there's no domain
#   %d - domain part in user@domain, empty if there's no domain
#   %h - home directory
#
# See </usr/share/doc/dovecot-common/wiki/Variables.txt> for full list.
# Some examples:
#
#   mail_location = maildir:~/Maildir
#   mail_location = mbox:~/mail:INBOX=/var/mail/%u
#   mail_location = mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%n
#
# </usr/share/doc/dovecot-common/wiki/MailLocation.txt>
#
#mail_location =
mail_location = maildir:~/Maildir

# [...]

Las ramas del árbol Maildir debe generarse a partir del home de cada usuario. Para esto, debe ser ejecutado el comando maildirmake.dovecot por cada usuario ya creado.

El comando más abajo muda la identidad del usuario corriente para un usuario “fribeiro” y crea la rama Maildir en el home del mismo usuario. Este comando debe repetirse con cada usuario ya existente:

root@server:~# su - fribeiro -c 'maildirmake.dovecot ~/Maildir'

Esta rama también debe ser creada sobre el directorio /etc/skel. El contenido de /etc/skelse utiliza como modelo para el directorio home de los usuarios que sean creados en el futuro. Así, cuando se activaran nuevos usuarios, las ramas de Maildir se generarían automáticamente:

root@server:~# maildirmake.dovecot /etc/skel/Maildir

Reiniciar el servidor:

root@server:~# /etc/init.d/dovecot restart

Verificar el servicio imap para las direcciones locales:

root@server:~# telnet 127.0.0.1 imap
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
  * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN] Dovecot ready.
a001 login fribeiro password
a001 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS] Logged in
a002 examine inbox
  * FLAGS (\Answered \Flagged \Deleted \Seen \Draft)
  * OK [PERMANENTFLAGS ()] Read-only mailbox.
  * 0 EXISTS
  * 0 RECENT
  * OK [UIDVALIDITY 1291979249] UIDs valid
  * OK [UIDNEXT 1] Predicted next UID
  * OK [HIGHESTMODSEQ 1] Highest
a002 OK [READ-ONLY] Select completed.
a003 logout
  * BYE Logging out
a003 OK Logout completed.
Connection closed by foreign host.

Desde otro sistema, verificar si son rechazadas las conexiones IMAP simples sim TLS por ser consideradas inseguras, una vez se envíen las contraseñas en texto simple:

fribeiro@laptop:~$ telnet 192.168.1.100 imap
Trying 192.168.1.100...
Connected to 192.168.1.100.
Escape character is '^]'.
  * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS LOGINDISABLED] Dovecot ready.
a001 login fribeiro password
  * BAD [ALERT] Plaintext authentication not allowed without SSL/TLS, but your client did it anyway. If anyone was listening, the password was exposed.
a001 NO [CLIENTBUG] Plaintext authentication disallowed on non-secure (SSL/TLS) connections.
a002 logout
  * BYE Logging out
a002 OK Logout completed.
Connection closed by foreign host.

Sin embargo, las conexiones IMAPS deben ser aceptadas a partir de cualquier sistema:

fribeiro@laptop:~# openssl s_client -connect 192.168.1.100:imaps
CONNECTED(00000003)
depth=0 /C=PT/ST=Portugal/O=Home Lan/CN=*.home.lan
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=PT/ST=Portugal/O=Home Lan/CN=*.home.lan
verify return:1
---
Certificate chain
 0 s:/C=PT/ST=Portugal/O=Home Lan/CN=*.home.lan
   i:/C=PT/ST=Portugal/O=Home Lan/CN=*.home.lan
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICBzCCAXACCQCBpikwVIulPjANBgkqhkiG9w0BAQUFADBIMQswCQYDVQQGEwJQ
VDERMA8GA1UECBMIUG9ydHVnYWwxETAPBgNVBAoTCEhvbWUgTGFuMRMwEQYDVQQD
FAoqLmhvbWUubGFuMB4XDTEwMTEwNTEyMDkxNFoXDTExMTEwNTEyMDkxNFowSDEL
MAkGA1UEBhMCUFQxETAPBgNVBAgTCFBvcnR1Z2FsMREwDwYDVQQKEwhIb21lIExh
bjETMBEGA1UEAxQKKi5ob21lLmxhbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
gYEAwvRP1cWKzoUPPtSUVK+G/HFgaoToc50Ir3gmBbhlycXPJvRbVwfF2+wBXdoS
pNzJdmi6iA0cwaiy2BiUpH4WCk+nZGrGyJDUafxOdaUt8G/64lmSeUedBf3sSoQ6
9iR+fq85uTCJkbe2ZXgkfYZ/djnnkX9BnA7fD7szWbv6StMCAwEAATANBgkqhkiG
9w0BAQUFAAOBgQCLnbmCLs8jwnwG8zL1a8BWxarjitmLbqwXgo+qXtzu0qeFrZJ2
f42bk9M3I83SeQUKTGvK9Mj7CXmorKEsDv18F6rzQO9x2UInrwXYN9BcMVg5YHsf
HQkwhzgWXZNWJT0drFgNKsugvug7dE1UWVFJgafXwACQIFOaLkqpLdznDw==
-----END CERTIFICATE-----
subject=/C=PT/ST=Portugal/O=Home Lan/CN=*.home.lan
issuer=/C=PT/ST=Portugal/O=Home Lan/CN=*.home.lan
---
No client certificate CA names sent
---
SSL handshake has read 1094 bytes and written 319 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: CF0CD4E5B509B27A41516D693EE5C8BF874FD19444FF2D28F5EAB078A5038324
    Session-ID-ctx:
    Master-Key: 98478963F48B5C45438DE5312A266B9C3E23BF0FC1E75CEF7FC633B363CE131266BAB17513E1357AB3074900F5D057CC
    Key-Arg   : None
    Start Time: 1291980431
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
  * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=PLAIN] Dovecot ready.
a001 login fribeiro password
a001 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS] Logged in
a002 examine inbox
  * FLAGS (\Answered \Flagged \Deleted \Seen \Draft)
  * OK [PERMANENTFLAGS ()] Read-only mailbox.
  * 0 EXISTS
  * 0 RECENT
  * OK [UIDVALIDITY 1291979249] UIDs valid
  * OK [UIDNEXT 1] Predicted next UID
  * OK [HIGHESTMODSEQ 1] Highest
a002 OK [READ-ONLY] Select completed.
a003 logout
  * BYE Logging out
a003 OK Logout completed.
closed

Como verificación final, puede crearse una cuenta en un cliente de e-mail, como Thunderbird: Para esto, debe seleccionarse el protocolo IMAP, la conexión requiere TLS (puerto 143) o SSL (puerto 993) y la dirección será la del servidor (192.168.1.100 o mail.home.lan, en caso de que haya configurado previamente un Servidor DNS para la red local).

Si se configuró el acceso sin TLS o SSL, el acceso será negado:

Dado que los certificados son auto-firmados, en los clientes e-mail aparecerá una ventana donde consta que no conocen la autoridad del certificado.

Una verificación debe indicar que el certificado utilizado es realmente el que queremos usar:

Una vez verificado el certificado, este podrá ser añadido a la lista de excepciones de seguridad.

• Dovecot (http://www.dovecot.org/)
• Wikipedia: Imap (http://es.wikipedia.org/wiki/Imap)
• Wikipedia: Imap (http://en.wikipedia.org/wiki/Imap)
• OpenSSL (http://www.openssl.org/)
• Wikipedia: OpenSSL (http://pt.wikipedia.org/wiki/Openssl)
• Wikipedia: TLS (http://es.wikipedia.org/wiki/Transport_Layer_Security)
• Wikipedia: TLS (http://en.wikipedia.org/wiki/Transport_Layer_Security)
• Securing Debian Manual, 5.6 Securing the mail service (http://www.debian.org/doc/manuals/securing-debian-howto/ch-sec-services.en.html#s5.6)