3

Hotmail appears to have two separate IMAP ports:

imap-mail.outlook.com 993

And:

imap-mail.outlook.com 143

My guess here is that 143 is unsecured, and 993 is over SSL. However, when I try to connect over 993:

telnet imap-mail.outlook.com 993

I just get a blank screen - no acknowledgement or greeting message. When I try the same thing over 143, I do get a message, but it's encrypted:

ImapLogin

Subsequently, issuing login commands fail:

. LOGIN myaddress@hotmail.co.uk mypassword

With:

. BAD Command received in Invalid state.

I can't even enter this on 993 as I don't get the greeting.

Please could someone advise me as to why this is not correctly connection, and possibly advise as to how to remedy the problem?

Paul Michaels
  • 215
  • 1
  • 3
  • 12
  • You should go read the RFCs specifying the IMAP standard; they will tell you how the protocol should be used. – Jenny D Aug 19 '17 at 12:40

1 Answers1

10

This is normal; it's exactly the same that happens, if you try to telnet HTTPS 443; the port 993 is for IMAPS, which uses TLS. In TLS connection (from RFC 5246, 7.4.1.2 Client Hello):

When a client first connects to a server, it is required to send the ClientHello as its first message. The client can also send a ClientHello in response to a HelloRequest or on its own initiative in order to renegotiate the security parameters in an existing connection.

The server doesn't greet you because you are supposed to greet it first!

The IMAP port 143 works differently, because it doesn't start the connection with TLS. The connection starts as plain text, and the client request for TLS with (RFC 3501, 6.2.1) STARTTLS:

A [TLS] negotiation begins immediately after the CRLF at the end of the tagged OK response from the server. Once a client issues a STARTTLS command, it MUST NOT issue further commands until a server response is seen and the [TLS] negotiation is complete.

Example:

C: a001 CAPABILITY
S: * CAPABILITY IMAP4rev1 STARTTLS LOGINDISABLED
S: a001 OK CAPABILITY completed
C: a002 STARTTLS
S: a002 OK Begin TLS negotiation now
<TLS negotiation, further commands are under [TLS] layer>
C: a003 CAPABILITY
S: * CAPABILITY IMAP4rev1 AUTH=PLAIN
S: a003 OK CAPABILITY completed
C: a004 LOGIN joe password
S: a004 OK LOGIN completed

In other words, both CAN be secure, but 143 isn't necessarily as it's also used for plain IMAP.

If you need to debug connection over TLS, you cannot use the telnet command, originally designed for the telnet protocol, for that. However, there are several other tools, e.g.

  • OpenSSL

     openssl s_client -connect imap-mail.outlook.com:993
 openssl s_client -starttls imap -connect imap-mail.outlook.com:143

  • GnuTLS

     gnutls-cli imap-mail.outlook.com -p 993
 gnutls-cli imap-mail.outlook.com -s -p 143

  • ncat and socat (no support for STARTTLS)

     ncat --ssl imap-mail.outlook.com 993
 socat openssl:imap-mail.outlook.com:993 stdio
 socat ssl:imap-mail.outlool.com:993 readline

  • On Debian, telnet-ssl -z ssl imap-mail.outlook.com 993

Community
  • 1
Esa Jokinen
  • 46,944
  • 3
  • 83
  • 129
  • Thanks for this! I think you've put me on the right track here - however, when I said the server doesn't acknowledge or greet me, it also doesn't allow text entry. Similarly, when I issue STARTTLS on 143, it tells me it's starting negotiations, but then loses connection. Presumably I am, for some reason, unable to establish a secure connection? – Paul Michaels Aug 19 '17 at 07:22
  • _You_ are, but your _email client_ can. You are just not capable of writing TLS encrypted traffic on your keyboard. Only _Akira Shirase_ a.k.a. [BPS](https://en.m.wikipedia.org/wiki/Battle_Programmer_Shirase) has such skills. – Esa Jokinen Aug 19 '17 at 07:44
  • Okay - but to be clear, you're saying that communication over IMAP using telnet is not possible with Hotmail, due to encryption? – Paul Michaels Aug 19 '17 at 08:33
  • It requires, among other things, calculations that are not very practical to make on paper. Encryption is designed to be programmed. – Esa Jokinen Aug 19 '17 at 09:01
  • 1
    Sorry, I understand what encryption is, I suppose what I was asking was more relating to telnet - can it not be given an ssl certificate ? – Paul Michaels Aug 19 '17 at 10:42
  • 1
    With `telnet`, no. But there are alternatives that works as you wish telnet would. Added some to my answer. – Esa Jokinen Aug 19 '17 at 11:42