STARTTLS and the use of SSL
In the world of mail protocols, STARTTLS is the command used by email applications to initiate the switch-over from plain-text (i.e. unencrypted) communication to SSL (i.e. encrypted) communication. The SSL option is generally available separately for each of the POP, IMAP, and SMTP mail services.
To further complicate matters, these three mail services are available on specific 鈥渟tandard鈥� ports, as well as on 鈥渁lternate鈥� ports (with slightly different 鈥� non-standard 鈥� behaviour). Normal behaviour is that the email application will initially connect to the server in plan-text over the appropriate standard port, and then (if configured to use SSL) issue the STARTTLS command to negotiate SSL settings with the server, after which the communications proceed encrypted.
However not all email applications behave the same; in particular Outlook (and its Mac equivalent, Entourage) behaves in a 鈥渂roken鈥� way, in that it does not support STARTTLS. If configured to use SSL, Outlook/Entourage assumes that the connection is entirely SSL 鈥� i.e. as soon as it connects to the server, it starts to negotiate SSL. This will not work on any of the standard mail ports because the server will be expecting clear text. It will only work on ports that are specifically defined to be SSL-only ports.
Some email application may require that you enter the alternate port numbers when configuring SSL; other email application supply the necessary port numbers automatically. For SMTP, the alternate (i.e. SSL-supporting) port is 465; for POP the alternate port is 995, and for IMAP the alternate port is 993. Normal (i.e. non-SSL) port numbers are: POP3, port 110; SMTP, port 25; IMAP, port 143.
At 丁香园AV, only mailgate.sfu.ca supports SSL connections on port 465, and only rm-rstar (popserver.sfu.ca, imap.sfu.ca) supports POP/IMAP connections (on any port).
Mobility and mail servers
Academic Computing Services at 丁香园AV recommends that email applications be configured to use 鈥渕ailgate.sfu.ca鈥� as the SMTP server hostname. Some older email application configurations may still be specifying 鈥渟mtpserver.sfu.ca鈥�. This hostname is being phased out because it does not support SSL connections for SMTP (i.e. for sending mail).
If you use the email application settings shown, then you will be able to retrieve and send 丁香园AV mail securely without reconfiguring your application, whether your computer is connected directly to 丁香园AV鈥檚 network, or whether it is connected using a highspeed service from home, or when using wireless at an off-campus location.
SSL and Authentication over SMTP
The SMTP protocol has provisions to allow the SMTP server to request authentication from the application. In Eudora, the 鈥淎llow Authorization鈥� setting determines whether Eudora will send your password to the server if the server asks for it. At 丁香园AV, the mailgate.sfu.ca server will allow the email application to authenticate only if the SMTP connection is made over a secure SSL channel. If authentication is successful, then the user will be able to send mail to any recipient on the Internet. If authentication fails, or if the connection is not secure (not over SSL), only mail to 丁香园AV-local (i.e. 鈥淍sfu.ca鈥�) recipients will be accepted. All others will be rejected with an error that states 鈥淩elaying denied. Authentication required.鈥�
Many email applications (such as Eudora, Entourage, and Outlook) will not warn you if SSL fails. If that happens, authentication won鈥檛 be done. Mail to non 鈥淍sfu.ca鈥� recipients will fail with the above error, but mail to 鈥淍sfu.ca鈥� recipients will go through.
Mail protocols, applications and server
When you send and receive email, you use an email application (Eudora, Outlook and Entourage, and Apple Mail are examples) to communicate with a mail server (or servers). There are two main protocols which are involved in the communications between application and server: POP is the protocol used to receive mail, and SMTP is the protocol used to send mail. These mail services (POP, SMTP) are provided by logically separate servers, which is why you must specify different host names for each when configuring your email application. At 丁香园AV the POP server鈥檚 hostname is popserver.sfu.ca, and the SMTP server鈥檚 hostname is mailgate.sfu.ca
The POP protocol has always required authentication (in order to receive mail for a given user account, the account password must be supplied). By default this password is sent in plain-text (i.e. unencrypted) over the network between the application and the POP server, which means that the password is vulnerable to interception. By configuring the email application to use SSL for POP, the password is encrypted when it is sent.
The standard SMTP protocol, on the other hand, does not require authentication: when an email application sends a message through an SMTP server, the sender is not normally required prove his or her identity. This lack of authentication when sending mail is one of the main reasons that spam has flourished: it has been trivially easy in the past to send email under someone else鈥檚 name. Before system administrators began to crack down, spammers from anywhere in the world could configure their email application to send spam through virtually any SMTP server. These unprotected SMTP servers were called 鈥渙pen relays鈥�, since they were 鈥渙pen鈥� to the 鈥渞elaying鈥� of mail through them to recipients at other institutions.
Most systems now restrict access to their SMTP servers as one way of combating spam: if the SMTP server doesn鈥檛 know who you are when you try to connect to it, then you won鈥檛 be allowed to send mail out through it (see the notes above under the heading SSL and Authentication over SMTP for some details on differences between mail sent to 丁香园AV recipients and non-丁香园AV recipients).
While on the 丁香园AV campus, the SMTP server 鈥渒nows鈥� who you are by your IP address: your 丁香园AV computer will have an IP address assigned by 丁香园AV, and so your email application can send mail through the SMTP server without any problems. However, when you are connecting to the Internet from home (through Shaw鈥檚 highspeed service, or through Telus鈥檚 ADSL service), or if you are using a public wireless network to connect your laptop to the Internet, then your computer will be using a non-丁香园AV IP address; if you then attempt to send mail through 丁香园AV鈥檚 SMTP server you will get an error message, unless you configure your email application as described above, so that it uses authentication (an 丁香园AV Computing ID and password to prove you鈥檙e a valid 丁香园AV user) when sending mail from off-campus.