0

I have been trying to get a client setup to an imap server. I've used both a native Java client, and the Apache Camel component for imap. Always get connection refused.
When I attempt to connect to the exact same IP using "curl", I get back the text banner expected, proving the server is available, and listening on 143. Attempting to connect with "openssl" always fails, however in other network segments, I've seen others succeed.
I tried some "tcpdump" monitoring with the following results.
When running openssl, the following is captured 

[root@CMMDEVINTHUB02 cpetty]# tcpdump -n -vvv host 10.237.103.30 and port 143
tcpdump: listening on eth3, link-type EN10MB (Ethernet), capture size 65535 bytes
12:26:49.884552 IP (tos 0x0, ttl 64, id 8763, offset 0, flags [DF], proto TCP (6), length 60)
    172.17.81.0.60869 > 10.237.103.30.imap: Flags [S], cksum 0x7a47 (correct), seq 3319911815, win 14600, options [mss 1460,sackOK,TS val 2753099708 ecr 0,nop,wscale 7], length 0

12:26:49.884692 IP (tos 0x0, ttl 254, id 55004, offset 0, flags [none], proto TCP (6), length 40) 10.237.103.30.imap > 172.17.81.0.60869: Flags [R.], cksum 0x7dec (correct), seq 0, ack 3319911816, win 14600, length 0
:

This seems to show an ordinary "connection refused", as if no listener. (this is consistent, so I'm sure not related to socket pool)

However, when running "curl", I get back the prompt below from imap:

[root@CMMDEVINTHUB02 prime]# curl 10.237.103.30:143
* OK The Microsoft Exchange IMAP4 service is ready.
GET BAD Command Error. 12
Via: BAD Command Error. 12
User-Agent: BAD Command Error. 12
* BYE Connection closed. 14

However, NOTHING SHOWS UP IN TCPDUMP. I don't understand what is going on here. Any ideas anyone? Thanks Clint

HBruijn
  • 77,029
  • 24
  • 135
  • 201
Clint
  • 1
  • Probably TLS is mandated to access your IMAP server. On port 143 that requires upgrading the connection with [STARTTLS](https://en.wikipedia.org/wiki/Opportunistic_TLS). With openssl you test that that with: `openssl s_client -starttls imap -connect servername:143` – HBruijn May 15 '17 at 13:08
  • Yes, it does require a switch to TLS, but throwing a connection refused doesn't even allow for communication of the switch request. Before any of that negotiation can take place, a basic TCP connection has to be present. I don't even get that far. Others using openssl to test this from other network segments, show that switch, and of course, openssl can handle it, immediately engaging in the session upgrade negotiation. – Clint May 15 '17 at 14:46

0 Answers0