Re: Localhost Dovecot server without ssl?
John Fawcett via dovecot <[email protected]>
| Newsgroups | gmane.mail.imap.dovecot |
|---|---|
| Message-ID | <[email protected]> |
On 21/02/2026 17:39, Steve Litt via dovecot wrote: > Hi all, > ... > > For the time being, I don't need to access my Dovecot IMAP from any > computer except my DDD, and therefore, I can serve Dovecot IMAP on > 127.0.0.1. > > So here's my question. Assuming (and I know this is a big assumption) > I'm not worried about somebody gaining physical possession of my DDD, > is there any reason not to use plain text to access this server? > > Thanks, > > SteveT > > Steve Litt > http://444domains.com > _______________________________________________ > dovecot mailing list -- [email protected] > To unsubscribe send an email to [email protected] Hi Steve I am assuming that by "use plain text" you mean that you will use an unencrypted connection over 127.0.0.1 port 143 rather than you're intending to authenticate by plain text. In general I do encrypt connections over localhost where possible, but it's just to be on the safe side. Having said that I think I have some things which are not encrypted, like the comunication between amavis and postfix, so I have accepted whatever risk there is in having unencrypted connnections in some cases. If your DDD is connected to the network as I understood, then the risk is that someone will gain unauthorized access to it and will be able to access traffic over the loopback interface, even if the level of access they gained wasn't sufficient to access the email files. Of course if this potential attacker gained sufficient access, they could just read the files without having to sniff loopback traffic. I suppose it boils down to how sure you are that your DDD is protected from unauthorized access and that encrypting the loopback traffic does mitigate something but does not help in all cases of unauthorized access. Having said that I have seen cases of unauthorized access from the internet to what was supposed to be a PC exposed only on the internal network. This happened due to an ipv6 address which was not properly firewalled and was therefore visible externally. However, in the case I saw, the PC was totally compromised and encrypting loopback traffic would not have mitigated anything. John _______________________________________________ dovecot mailing list -- [email protected] To unsubscribe send an email to [email protected]