secure webmail

Hi

I have my webmail working with SUSE10, postfix, cyrus and squirrlemail.

My issue is how can I make it secure??

In other words instead of typing http://www.xxxx.com/webmail make it
https://www.xxxx.com/webmail that way the password are encrypted and what
the viewer is seeing also.

Thanks any help is apreciated!!

"miguel-lopes" <milopes@hotmail.com> wrote in message
news:IPudnXoCJ7nWZffYnZ2dnUVZ8tydnZ2d@novis.pt...
> Hi
>
> I have my webmail working with SUSE10, postfix, cyrus and squirrlemail.
>
> My issue is how can I make it secure??
>
> In other words instead of typing http://www.xxxx.com/webmail make it
> https://www.xxxx.com/webmail that way the password are encrypted and what
> the viewer is seeing also.
>
> Thanks any help is apreciated!!

To generate the certificate itself:

http://tldp.org/HOWTO/SSL-RedHat-HOWTO-3.html

http://www.rpatrick.com/tech/makecert/

Then you need to change the Apache config file to listen on Port 443 and use
the key/certificate.

http://tldp.org/HOWTO/SSL-RedHat-HOWTO-4.html#configure

You can also pay for a certificate that is traceable to a certification
authority ... but that is a separate question. Except for the nag given by
most or all browsers, a self-signed is fine.

don't forget though email is inherently insecure, sending stuff in
plain text, all you are doing here is securing the data from your web
server to your user and back.
To make a truly secure system, you should use SSL, but then unless your
mail server is on the same machine as the web server consider using
Secure SMTP to the server. (like gmail)
Then you have the problem of the SMTP server's network, and all
networks after that including the pop network for the recipient, as
well as his/her network once the mail has been downloaded from the pop
server.
Anything that important should be sent using certificate encrypted
mail. That requires the recipient has a public cert. PHP has funcitons
that can use a persons public cert to encrypt the mail.
I am assuming here that all you want is "cant eavesdrop on the GET/POST
to the web server" in which case yeah SSL.