Messaging Server Administrator's Guide: Configuring IMAP and POP Services

Note: Messaging Server 4.0 supports POP over SSL, but not through a separate port from POP. In any case, some client software (such as the current release of Netscape Messenger, the Netscape mail client) does not support POP over SSL.

Service Banner

When a client first connects to the Messaging Server IMAP or POP port, the server sends an identifying text string to the client. This service banner (not normally displayed to the client's user) identifies the server as Netscape Messaging Server, gives the server's version number, and notes the time of connection. The banner is most typically used for client debugging or problem-isolation purposes.

You can replace the default banner for the IMAP or POP service if you want a different message sent to connecting clients.

Login Requirements

You can control how users are permitted to log in to the IMAP or POP service to retrieve mail. You can allow anonymous login (for IMAP only), password-based login, and certificate-based login. This section provides background information; see Configuring IMAP and POP with Netscape Console for the steps you follow to make these settings.

Anonymous Login

Anonymous login refers to a user logging in under the special user name anonymous, which requires no password. (By convention analogous to that of FTP, users enter their email addresses as passwords, so that their accesses are logged.) One reason for permitting anonymous login might be to provide read-only access to, for example, archived messages of a mailing list.

By default, anonymous login for IMAP is disabled. Anonymous login is not available for the POP service.

Password-Based Login

In typical messaging installations, users access their IMAP or POP mailboxes by entering a password into their mail client. The client sends the password to the server, which uses it to authenticate the user. If the user is authenticated, the server decides, based on access-control rules, whether or not to grant the user access to certain mailboxes stored on that server.

If you allow password login, users can access IMAP or POP by entering a password. Passwords are stored in an LDAP directory and can be either clear text or encrypted. Directory policies determine what password policies, such as minimum length, are in effect.

If you disallow password login, password-based authentication is not permitted. Users are then required to use certificate-based login, as described in the next section.

To increase the security of password transmission when you have selected password-based login, you can specify that passwords be encrypted before they are sent to your server. You do this by selecting a minimum cipher-length requirement for login.

If you choose 0, you do not require encryption. Passwords are sent in the clear or they are encrypted, depending on client policy.

If you choose a nonzero value, the client must establish an SSL session with the server--using a cipher whose key length is at least the value you specify--thus encrypting any IMAP or POP user passwords the client sends.

If the client is configured to require encryption with key lengths greater than the maximum your server supports, or if your server is configured to require encryption with key lengths greater than what the client supports, password-based login cannot occur. See Enabling SSL for information on setting up your server to support various ciphers and key lengths.

Certificate-Based Login

In addition to password-based authentication, Netscape servers support the authentication of users through examination of their digital certificates. Instead of presenting a password, the client presents the user's certificate when it establishes an SSL session with the server. If the certificate is validated, the user is considered authenticated.

For instructions on setting up Messaging Server to accept certificate-based user login to the IMAP service, see Setting Up Certificate-Based Login.

You don't need to uncheck the "Allow plaintext-password login" box in the IMAP System form to enable certificate-based login. If the box is checked (its default state), and if you have performed the tasks required to set up certificate-based login, both password-based and certificate-based login are supported. Then, if the client establishes an SSL session and supplies a certificate, certificate-based login is used. If the client does not use SSL or does not present a client certificate, the server requests a password.

Performance Parameters

You can set some of the basic performance parameters for the IMAP and POP services of Messaging Server. Based on your hardware capacity and your user base, you can adjust these parameters for maximum efficiency of service. This section provides background information; see Configuring IMAP and POP with Netscape Console for the steps you follow to make these settings.

Number of Processes

Messaging Server can divide its work among several executing processes, which in some cases can increase efficiency. This capability is especially useful with multiprocessor server machines, in which adjusting the number of server processes can allow more efficient distribution of multiple tasks among the hardware processors.

There is a performance overhead, however, in allocating tasks among multiple processes and in switching from one process to another. The advantage of having multiple processes diminishes with each new one added. A simple rule of thumb for most configurations is to have one process per hardware processor on your server machine, up to a maximum of perhaps 4 processes. Your optimum configuration may be different; this rule of thumb is meant only as a starting point for your own analyses.

Note: On some platforms you might also want to increase the number of processes to get around certain per-process limits (such as the maximum number of file descriptors), specific to that platform, that may affect performance.

The default number of processes is 1 for both IMAP and POP.

Number of Connections per Process

The more simultaneous client connections your IMAP or POP service can maintain, the better it is for clients. If clients are denied service because no connections are available, they must then wait until another client disconnects.

On the other hand, each open connection consumes memory resources and makes demands on the I/O subsystem of your server machine, so there is a practical limit to the number of simultaneous sessions you can expect the server to support. (You might be able to increase that limit by increasing server memory or I/O capacity.)

IMAP and POP have different needs in this regard: