howto://connect clients to exchange-part one

Before you go there, I am not talking about connecting Outlook to Exchange on the LAN. I’m talking about those other situations, like the graphics guy using Mac Mail, or the security guy using Thunderbird on Linux, or someone with a Windows Mobile device, or even you with your iPhone.

In this two part series, we are going to first cover how to securely enable POP3 and IMAP for those clients that can’t (or won’t) use Outlook, and in the second half of this series, howto://connect clients to exchange-part two, we will cover how to use ActiveSync for Windows Mobile, Droid, and iPod Touch/iPhone/iPads, and also how to support remote Outlook connections without a VPN using Outlook Anywhere. If you need to support POP3 and/or IMAP, read on for how to get it done.

Exchange 2010 does support POP3 and IMAP out of the box. It also supports the secure versions using TLS and either a self-signed certificate or one that you get from your trusted CA. However, none of this is turned on by default. If you try to connect a client at this point, you will get nothing but fails and RST ACKS. To enable these services, do this.

Enabling IMAP and POP3 services

Open a cmd prompt, and run netstat –an | more [enter] If you check listening ports on your CAS server, you will see that he is not listening on POP3, POPS, IMAP, or IMAPS. Of course it is listening on SMTP and SMTPS, which you will need for these clients to send mail.
To enable these services, launch services.msc. Find the Microsoft Exchange IMAP4 and Microsoft Exchange POP3 services. There are only the two…IMAP4 handles cleartext and secure IMAP, and POP3 handles cleartext and secure POP3.
Configure the IMAP4 service to start automatically.
Then, start it.
Repeat the same process for the POP3 service.
Now check again with netstat and you will see that you have listeners for 110-POP3, 143-IMAP, 993-IMAPS, and 995-POPS.
Do your happy dance.

Restricting access to IMAP and POP3 services

Strictly speaking, you are done on the server side. Any clients on the internal network should be able to connect. All users will be permitted to connect using POP3 or IMAP4 (and their secure counterparts) by default. If you want to restrict this, you can edit the individual mailboxes and disable specific protocols, like this.

Note that disabling IMAP in this way hits both IMAP4 and Secure IMAP. You don’t do this to disable cleartext…you handle that as shown below.

Securing IMAP and POP3 services with TLS

As you should be aware, IMAP and POP3 are both cleartext protocols. All data, including authentication, is transmitted in the clear. It would be a shame to implement a strong password policy, aggressive lockout settings, and auditing in AD only to have the first guy with Wireshark start grabbing everyone’s domain credentials as they connect to Exchange using cleartext protocols. To prevent that, you want to set both to require TLS.

Launch the Exchange Management Console.
Browse down to Server Configuration, Client Access.
Click on the POP3 and IMAP4 tab.
Right-click on IMAP4, choose properties, and then go to the Authentication tab.
Select Secure logon, and if necessary, enter the friendly name of the appropriate certificate.
Do the same for the POP3 service.
Restart both services using services.msc. You must do this for the settings to take effect.

With that, you are done. Internal clients are now able to connect securely to the POP3 and IMAP services, using their domain credentials. MAPI connections from Outlook are still the way to go whenever you have the option, but this should let you support a wider range of client without compromising security. Of course this requires that these clients be on the LAN, or connected by VPN. What if you want to permit connections from outside of your network without requiring VPN?

Connecting from the Internet using TMG

You might consider requiring a VPN connection before allowing access to POP3 and IMAP. This would reduce the number of open ports on the Internet, at the cost of requiring additional efforts on the client. Since ActiveSync clients will use only https to connect, the number of folks this will impact may not be significant.

Please also keep in mind that if you do publish these through the TMG, you are basically doing port forwarding. TMG cannot do SSL proxying for IMAP/POP3/SMTP, so your external clients (and the bad guys) will all be passing traffic directly to your CAS server. If that is acceptable, here is how to do it.

Log on to your TMG server and launch the TMG Management Console.
Browse down to Firewall Policy, right-click it, and click New, Mail Server Publishing Rule…
Give it a name, and click next.
Since this is for our clients, leave the option for Client access: and click Next.
Since we only want to support the secure services that use SSL/TLS, we’re only going to select those options here. You may need to enable others for your situation. Then click Next.
Enter the internal ip.addr of your CAS server, then click Next.
Select the external ip.addr you wish to use, and click Next.
Click Finish, click Apply, and then enter your documentation.

That’s it. Now you just get the fun of setting up your clients. I don’t plan to cover any of that here except for getting iPhone/iPod Touch/iPad devices working with ActiveSync. That will be covered in an upcoming post, howto://connect your iphone to exchange with activesync. And don’t forget to check back for part two of this post, howto://connect your iphone to exchange with activesync, where we will cover ActiveSync and Outlook Anywhere. Until then, I can hardly throw an animated gif of Snoopy dancing into this post without taking it one step further. This should bring back some childhood memories.

Direct link for RSS and email subscribers…http://www.youtube.com/watch?v=rNremK0cBEg

If you found this post useful, please consider following us on twitter. You’ll be the first to learn about new posts, and, rarely, you’ll get to share a comedic or witty tweet. Of course, you can also leave a comment below (anonymous allowed) to let us know we hooked you up.