Sean WhalenandClaude Opus 5.5
33ca4ecf71
With [smtp] ssl = False (the default) or [imap] ssl = False, mailsuite upgraded the connection only if the server's plain-text EHLO/CAPABILITY reply advertised STARTTLS, and otherwise authenticated in plain text. An on-path attacker who stripped STARTTLS received the credentials and the emailed results (CWE-319). - Require mailsuite >= 2.3.4 (GHSA-2x4j-7g3q-wr6f), whose default refuses to authenticate over a connection that was not upgraded. - Add [imap] and [smtp] starttls (unset = require STARTTLS; false = explicit plain-text opt-out, for loopback servers such as DavMail), with a startup warning when the opt-out is set and ssl is False. - Add a starttls argument to email_results(). - Document both options; set starttls = False in the DavMail example. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
4.5 KiB
Accessing an inbox using OWA/EWS
:::{note} Starting in 8.0.0, parsedmarc supports accessing Microsoft/Office 365 inboxes via the Microsoft Graph API, which is preferred over DavMail. :::
Some organizations do not allow IMAP or the Microsoft Graph API, and only support Exchange Web Services (EWS)/Outlook Web Access (OWA). In that case, DavMail will need to be set up as a local EWS/OWA IMAP gateway. It can even work where Modern Auth/multi-factor authentication is required.
To do this, download the latest davmail-version.zip from
https://sourceforge.net/projects/davmail/files/
Extract the zip using the unzip command.
Install Java:
sudo apt-get install default-jre-headless
Configure DavMail by creating a davmail.properties file
# DavMail settings, see http://davmail.sourceforge.net/ for documentation
#############################################################
# Basic settings
# Server or workstation mode
davmail.server=true
# connection mode auto, EWS or WebDav
davmail.enableEws=auto
# base Exchange OWA or EWS url
davmail.url=https://outlook.office365.com/EWS/Exchange.asmx
# Listener ports
davmail.imapPort=1143
#############################################################
# Network settings
# Network proxy settings
davmail.enableProxy=false
davmail.useSystemProxies=false
davmail.proxyHost=
davmail.proxyPort=
davmail.proxyUser=
davmail.proxyPassword=
# proxy exclude list
davmail.noProxyFor=
# block remote connection to DavMail
davmail.allowRemote=false
# bind server sockets to the loopback address
davmail.bindAddress=127.0.0.1
# disable SSL for specified listeners
davmail.ssl.nosecureimap=true
# Send keepalive character during large folder and messages download
davmail.enableKeepalive=true
# Message count limit on folder retrieval
davmail.folderSizeLimit=0
#############################################################
# IMAP settings
# Delete messages immediately on IMAP STORE \Deleted flag
davmail.imapAutoExpunge=true
# Enable IDLE support, set polling delay in minutes
davmail.imapIdleDelay=1
# Always reply to IMAP RFC822.SIZE requests with Exchange approximate
# message size for performance reasons
davmail.imapAlwaysApproxMsgSize=true
# Client connection timeout in seconds - default 300, 0 to disable
davmail.clientSoTimeout=0
#############################################################
Running DavMail as a systemd service
Use systemd to run davmail as a service.
Create a system user
sudo useradd davmail -r -s /bin/false
Protect the davmail configuration file from prying eyes
sudo chown root:davmail /opt/davmail/davmail.properties
sudo chmod u=rw,g=r,o= /opt/davmail/davmail.properties
Create the service configuration file
sudo nano /etc/systemd/system/davmail.service
[Unit]
Description=DavMail gateway service
Documentation=https://sourceforge.net/projects/davmail/
Wants=network-online.target
After=syslog.target network.target
[Service]
ExecStart=/opt/davmail/davmail /opt/davmail/davmail.properties
User=davmail
Group=davmail
Restart=always
RestartSec=5m
[Install]
WantedBy=multi-user.target
Then, enable the service
sudo systemctl daemon-reload
sudo systemctl enable davmail.service
sudo service davmail restart
:::{note}
You must also run the above commands whenever you edit
davmail.service.
:::
:::{warning}
Always restart the service every time you upgrade to a new version of
davmail:
sudo service davmail restart
:::
To check the status of the service, run:
service davmail status
:::{note}
In the event of a crash, systemd will restart the service after 5
minutes, but the service davmail status command will only show the
logs for the current process. To view the logs for previous runs as
well as the current process (newest to oldest), run:
journalctl -u davmail.service -r
:::
Configuring parsedmarc for DavMail
Because you are interacting with the DavMail server over the loopback
(i.e. 127.0.0.1), add the following options to the parsedmarc.ini
config file:
[imap]
host=127.0.0.1
port=1143
ssl=False
starttls=False
[mailbox]
watch=True
The DavMail configuration above runs its IMAP listener without TLS
(davmail.ssl.nosecureimap=true), so parsedmarc refuses to log in unless
starttls=False allows plain-text authentication. Only set it when DavMail
listens on the loopback address only (davmail.bindAddress=127.0.0.1 and
davmail.allowRemote=false, as above).