Configuring POP3 and IMAP4 Authentication
By default, POP3 and IMAP4 clients pass connection information and
message data through an insecure connection. If corporate security is a
high priority, however, your information security team might require
mail clients to connect over secure communication channels. You have
several options for configuring secure communications, including
plain-text authentication, logon using integrated Windows authentication, and a fully secure logon using TLS.
You configure communications using plain-text authentication logon with or without integrated Windows authentication by completing the following steps:
-
In the Exchange Management Console, expand the Server Configuration node, and then select the Client Access node. -
In the upper portion of the details pane, you'll see a list of your
organization's Client Access servers. Select the server with which you
want to work. -
In the lower portion of the details pane, on the POP3 And IMAP4 tab, you'll see separate entries for POP3 and IMAP4. -
Right-click POP3 or IMAP4 as appropriate for the protocol you want to work with and then select Properties. -
On the Authentication tab, shown in Figure 2, do one of the following and then click OK:
-
Select Plain Text Logon (Basic Authentication) to use unsecure plain text for communications. -
Select Plain Text Authentication Logon (Integrated Windows
Authentication) to use secure communications with Windows
authentication.
-
Use the Services utility to restart the Exchange POP3 or IMAP4 service. Restarting the service applies the new settings.
You configure secure TLS communications by completing the following steps:
-
Ensure that an X.509 certificate is installed on your organization's Client Access servers . -
Configure the server to require secure TLS communications as follows:
-
In the Exchange Management Console, expand the Server Configuration node, and then select the Client Access node. -
In the upper portion of the details pane, you'll see a list of your
organization's Client Access servers. Select the server with which you
want to work.
-
In the lower portion of the details pane, on the POP3 And IMAP4 tab, you'll see separate entries for POP3 and IMAP4. -
Right-click POP3 or IMAP4 as appropriate for the protocol you want to work with, and then select Properties. -
On the Authentication
tab, select the Secure Logon option and ensure that the certificate
name in the X.509 Certificate Name text box is the correct one to use
for TLS connections. If not, enter the name of the appropriate certificate. Click OK.
-
Use the Services utility to restart the Exchange POP3 or IMAP4 service. Restarting the service applies the new settings. -
You can configure an Outlook client to use TLS by completing the following steps:
-
In Office Outlook 2007, select Account Settings on the Tools menu. In
Office 2010, click the Office button, click Account Settings, and then
select the Account Settings option. -
In the Account Settings dialog box, select the POP3/IMAP4 account, and then click Change. -
In the Change E-Mail Account dialog box, click More Settings. -
On the Advanced tab in the Internet E-Mail Settings dialog box, select TLS or Auto as the type of encrypted connection. -
Click OK. Click Next and then click Finish. Click Close.
Configuring Connection Settings for POP3 and IMAP4
You can control incoming connections to POP3 and IMAP4 in two ways.
You can set a limit on the number of simultaneous connections, and you
can set a connection time-out value.
POP3 and IMAP4 normally accept a maximum of 2,000 connections each
and a maximum of 16 connections from a single user, and in most
environments these are acceptable settings. However, when you're trying
to prevent the underlying server hardware from becoming overloaded or
you want to ensure resources are available for other features, you might
want to restrict the number of simultaneous connections even further.
When the limit is reached, no other clients are permitted to access the
server. The clients must wait until the connection load on the server
decreases.
The connection time-out value determines when idle connections are
disconnected. Normally, unauthenticated connections time out after
they've been idle for 60 seconds and authenticated connections time out
after they've been idle for 1,800 seconds (30 minutes). In most
situations, these time-out values are sufficient. Still, at times you'll
want to increase the time-out values, and this primarily relates to
clients who get disconnected when downloading large files. If you
discover that clients are being disconnected during large downloads, the
time-out values are one area to examine. You'll also want to look at
the maximum command size. By default, the maximum command size is
restricted to 45 bytes.
You can modify connection limits and time-outs by completing the following steps:
-
In the Exchange Management Console, expand the Server Configuration node, and then select the Client Access node. -
In the upper portion of the details pane, you'll see a list of your
organization's Client Access servers. Select the server with which you
want to work. -
In the lower portion of the details pane, on the POP3 And IMAP4 tab, you'll see separate entries for POP3 and IMAP4. -
Right-click POP3 or IMAP4 as appropriate for the protocol you want to
work with and then select Properties. In the Properties dialog box,
click the Connection tab. (See Figure 3.) -
To set time-out values for authenticated and unauthenticated
connections, enter the desired values in the Authenticated Time-Out and
Unauthenticated Time-Out text boxes, respectively. The valid range for
authenticated connections is from 30 to 86,400 seconds. The valid range
for unauthenticated connections is from 10 to 3,600 seconds. -
To set connection limits, enter the desired limits in the text boxes
on the Connection Limits panel. The valid input range for maximum
connections is from 1 to 25,000. The valid input range for maximum
connections from a single IP address is from 1 to 1,000. The valid input
range for maximum connections from a single user is from 1 to 1,000.
The valid input range for maximum command size is from 40 to 1,024
bytes.
-
Click OK to save your settings. Use the Services utility to restart
the Exchange POP3 or IMAP4 service. Restarting the service applies the
new settings.
Configuring Message Retrieval Settings for POP3 and IMAP4
Message retrieval settings for POP3 and IMAP4 control the following options:
-
Message formatting Message format
options allow you to set rules that POP3 and IMAP4 use to format
messages before clients read them. By default, when POP3 or IMAP4
clients retrieve messages, the message body is converted to the best
format for the client and message attachments are identified with a
Multipurpose Internet Mail Extensions (MIME) content type based on the
attachment's file extension. You can change this behavior by applying
new message MIME formatting rules. Message MIME formatting rules
determine the formatting for elements in the body of a message. Message
bodies can be formatted as plain text, HTML, HTML and alternative text,
enriched text, or enriched text and alternative text. -
Message sort order Message sort
order options allow you to control the time sorting of messages during
new message retrieval. By default, POP3 and IMAP4 sort messages in
descending order according to the time/date stamp. This ensures that the
most recent messages are listed first. You can also sort messages by
ascending order, which places newer messages lower in the message list. -
Calendar Retrieval Calendar retrieval
settings control the technique used for retrieval of calendar items. By
default, IMAP4 uses the iCalendar standard for retrieval of calendar
items. Alternatively, you can specify an internal or external URL with
which users can access their calendar information, or you can specify a
custom URL for the organization's OWA server.
You can modify message retrieval settings by completing the following steps:
-
In the Exchange Management Console, expand the Server Configuration node, and then select the Client Access node. -
In the upper portion of the details pane, you'll see a list of your
organization's Client Access servers. Select the server with which you
want to work. -
In the lower portion of the details pane, on the POP3 And IMAP4 tab, you'll see separate entries for POP3 and IMAP4. -
Right-click POP3 or IMAP4 as appropriate for the protocol you want to
work with and then select Properties. In the Properties dialog box,
click the Retrieval Settings tab. (See Figure 4, which shows this tab for POP3 and for IMAP4.)
-
Use the Message MIME Format list to choose the desired body format
for messages. As discussed previously, the options are Text, HTML, HTML
And Alternative Text, Enriched Text, Enriched Text And Alternative Text,
or Best Body Format. -
If you are working with POP3, use the Message Sort Order list to
specify the default sort order for message retrieval. Select Descending
for descending sort order during message retrieval or Ascending for
ascending sort order. -
Use the Calendar Retrieval
options to specify the technique to use for retrieving calendar items.
As discussed previously, the options are iCalendar, Intranet URL,
Internet URL, or Custom. If you select Custom, specify the URL of the
organization's OWA server in the additional text box provided. -
Click OK to save your settings. Use the Services utility to restart
the Exchange POP3 or IMAP4 service. Restarting the service applies the
new settings.
|
