MailEnable¶
MailEnable is a mail server for Windows. The risks are the same as any mail server: passwords crossing the network in plain text, mailboxes nobody uses, and passwords stored where anyone can read them.
Manage it¶
MailEnable Administrator (Start menu). Configuration files are under C:\Program Files (x86)\Mail Enable\Config\.
Encrypt the connections¶
POP3 and IMAP without TLS send every password in clear text.
Servers → Localhost → Services and Connectors → right-click POP → Properties → SSL tab → tick Enable SSL with a certificate. Repeat for IMAP and SMTP.
Verify the secure ports are listening:
Get-NetTCPConnection -State Listen | Where LocalPort -in 993,995,465 | Select LocalPort
993 is IMAPS, 995 is POP3S, 465 is SMTPS. Once they're up, consider disabling the plain ports (110, 143) if every client can use TLS.
Mailboxes¶
Messaging Manager → Post Offices → the post office → Mailboxes. Each one is an account. Disable or delete any that don't belong to a current, authorized user. Change any password the README reveals or that's obviously weak.
Password storage¶
MailEnable stores mailbox credentials in Config\AUTH.TAB. By default they can be in plain text, which means anyone who can read the file has every password.
Post office → Properties → security settings → enable encrypted password storage. After changing it, open AUTH.TAB and confirm the password column is no longer readable.
Other settings worth checking¶
- SMTP → Properties → Relay: don't relay for anyone; only authenticated senders.
- SMTP → Security: enable authentication requirements.
- Logging on for each connector.
Verify¶
Get-NetTCPConnection -State Listen | Where LocalPort -in 993,995 | Measure | Select Count
Select-String -Path "C:\Program Files (x86)\Mail Enable\Config\AUTH.TAB" -Pattern "Passw0rd"
Count of 2 for the secure ports. The second command should find nothing if you searched for a password you know was in the file before.
Example¶
AUTH.TAB contains bob Summer2024! in plain text. The README lists three mailboxes; the server has five. Enable encrypted storage, delete the two extra mailboxes, change bob's password, and enable SSL on POP and IMAP.