Chapter 8. Build a Secure Web-Mail Service Supporting IMAP and SSL

Difficult-o-Meter: 3 (moderate Linux skill required)

Covers:

Aeromail	http://the.cushman.net/reverb/aeromail/
IMAP	http://www.washington.edu/imap/
SSL	http://www.modssl.org/
	http://www.openssl.org/
PHP	http://www.php.net
Apache	http://www.apache.org
Required	gcc
	g++
	Perl 5.6
	sendmail
	inetd

This chapter will describe how you can set up your Linux computer to be a Web-based e-mail system for yourself or a group of friends . It will work best, of course, if you are on a dedicated Internet connection, like a cable modem or a DSL line at home. This will provide you with a secure method to check your e-mail from remote locations without having to add insecure connection methods that could be used by an attacker. While your friends and coworkers complain when their free Web-based e-mail system is inaccesible, yours will be humming along.

The combination of software we will be using is Apache with mod_ssl and PHP4, and the Web-mail package we describe later is Aeromail. We chose this combination because it is under active development (as of this writing), very easy to install, and quite feature rich. We also describe some additional Web-mail packages at the end of the chapter and provide several resources for more information.

We assume that you haven't installed a Web server or the SSL libraries on your system, which we will cover here. While it may seem like a lot of different components , it's really quite simple. Furthermore, your secure Web server can be used for other things you may wish to experiment with.

The general steps we will be using are quite direct. First we will install the basic connectivity for the mail server, the IMAP server, and secure it to accept only local connections. Secondly, we'll build a powerful Web server, one that supports secure socket layer (SSL) connections and the PHP scripting language. After that, the actual software used to display your mail on a Web page is quite simple to install.

To begin with, these are the files we have downloaded and their versions:

  -rw-r--r-- 1 jose jose 22841 Nov 19 15:18 aeromail-1.40.tar.gz

  -rw-r--r-- 1 jose jose 2847497 Oct 25 19:14 apache_1.3.14.tar.Z

  -rw-r--r-- 1 jose jose 1866035 Oct 25 13:27 imap.tar.Z

  -rw-r--r-- 1 jose jose 748253 Oct 25 19:15 mod_ssl-2.7.1-1.3.14.tar.gz

  -rw-r--r-- 1 jose jose 2086131 Sep 24 11:46 openssl-0.9.6.tar.gz

  -rw-r--r-- 1 jose jose 2225976 Nov 5 13:31 php-4.0.3pl1.tar.gz

The versions were chosen because they provide the most features and stability plus contain the latest security patches as of this writing. You're definitely encouraged to use at least these versions. The IMAP server we're using is the latest version available.

Now that you've obtained the pieces needed, we'll get to work. Building things shouldn't take too long, approximately one hour on a 300-MHz system. The longest waits are, of course, during the compilations. For reference, we will be keeping all of the archives in one directory, webmail/, as we build them. We'll be installing to the default Apache directory, /usr/local/apache/htdocs/.