search

simonrob / email-oauth2-proxy

An IMAP/POP/SMTP proxy that transparently adds OAuth 2.0 authentication for email clients that don't support this method.
Apache License 2.0
797 stars 86 forks source link

TLS Question? #182

Closed proxyheavennhell closed 1 year ago

proxyheavennhell commented 1 year ago

Hi,

Love the script, it's awesome!

Just a quick question - is the comms between the proxy python script and the remote exchange server (Office 365) TLS secured?

I only ask as can see this type of thing in the log file:

"New incoming connection to IMAP server at 172.17.0.2:1993 (unsecured) proxying outlook.office365.com:993 (SSL/TLS) Accepting new connection to IMAP server at 172.17.0.2:1993 (unsecured) proxying outlook.office365.com:993 (SSL/TLS) via ('172.17.0.2', 36372) IMAP (172.17.0.2:1993; 172.17.0.2:36372->outlook.office365.com:993) --> [ Client connected ] IMAP (172.17.0.2:1993; 172.17.0.2:36372->outlook.office365.com:993) <-> [ Starting TLS handshake ] IMAP (172.17.0.2:1993; 172.17.0.2:36372->outlook.office365.com:993) <-> [ TLSv1.2 handshake complete ] IMAP (172.17.0.2:1993; 172.17.0.2:36372->outlook.office365.com:993) <-- b'* OK The Microsoft Exchange IMAP4 service is ready."

However no SSL certs have been set up on the server running the proxy, so I'm a bit confused here...?

Also, what is port '36372' used for by the proxy script?

Thanks v much, Steve.

simonrob commented 1 year ago

Thanks – glad you find it useful.

The proxy always creates a secure connection to the remote server. It uses the system's certificates to do this, so no setup is required on your behalf. This approach doesn't work for local connections, which is why some extra setup is needed if this is required.

The 36372 here is the source port that is being used for the outbound connection.

proxyheavennhell commented 1 year ago

Awesome - thanks!

Can I just ask which 'system' certificates it uses on a Linux server please? I'm just curious as I'm not a Linux admin but would like to know where they are located?

Thanks v much

simonrob commented 1 year ago

It uses whatever your python installation provides – see the documentation for more details here.