Secure email & webmail [and DA panel]

[zEitEr]

You can add your mod_rewrite directives (check hostname and redirect user to https://hostname/webmail) to /etc/httpd/conf/extra/httpd-includes.conf, then it will remain there even after "./build rewrite_confs".

 

[scsi]

Thank you

THat's what I did for the DA panel.
It works well to bring ur client from http://www.theirdomain:2222 to https://hostname:2222
But it doesn't for https://www.theirdomain:2222 towards https://hostname:2222

You absolutely cannot make https to https connection without an error first because ssl handshake takes place before looking at the vhost. This is no way around it at all.

 

[Duboux]

Actually, something I came across to...

The downside of having secure mail access, is that once clients start using the hostname as mail-server in their email-software, they will start having problems, the minute their account is being moved from server...

 

[zEitEr]

In this case, you might want to create a separate login page with frame/iframe... and with JavaScript onSubmit modify action in the form and open webmail from desired web-server. So let's say https://webmails-login.domain.com/ contains a form, and as soon as your user specifies his/her credentials, the form gets submitted to a correct web-server's page.

Do you get what I mean? I hope, it's clear.

 

[Duboux]

Yes, that's an excelent idea for the webmail.
But what to do with the values users use for mail-server/smtp-server/imap-server in their email-clients ?

 

[SeLLeRoNe]

mail.theirdomain.tld?

 

[Duboux]

Yes, but that doesn't provide a secure mail-client <--> server connection
Unless I buy an expensive multi-domain certificate, or a certi per domain

 

[SeLLeRoNe]

Well, you should use a self-signed cert and use port 587/465 for smtp and tell your customers is nothing to scare about...

Actually afaik DA doenst have yet a cloud service for this kind of things, ive read they are working on it but there is no eta untill now.

Regards

 

[zEitEr]

Yes, that's an excelent idea for the webmail.
But what to do with the values users use for mail-server/smtp-server/imap-server in their email-clients ?

SMTP relay? POP3/IMAP proxy?

 

[NoBaloney2]

Do you move your users between servers often enough that it's a problem for you to give them the servername?

Jeff

 

[Duboux]

well.. maybe 3x per user-lifetime.

For example when the server is starting to show hardware failure signs.
Or when a server has been compromised.
Or when it's handy to balance the load by moving some users.

In any case, I guess, when using the hostname as mail-server address, I can't use it for clustered users. As 2 MX records would need to point towards the same hostname, which can only function on 1 server, right ?

 

[zEitEr]

If you want one point of entrance for SMTP and POP3/EMAIL you should use some kind of a balancer, or proxy (or a virtual IP, though not sure if it can be used in this particular case). I don't know any other way to achieve the desired.

p.s.

Nginx is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server.

http://wiki.nginx.org/Main