Home › How To

How to telnet to a POP server that requires SSL

3 January, 2008 - 17:18 — Keith
If you are anything like me, then every now and then you want to access a mail (POP3) server directly to sort out a problem without having a "helpful" email client get in the way. In these cases connecting to port 110 with telnet is the way to go.

But what about when the mail server has been set up to not allow plan-text connections (i.e. an SSL connection must be used)?


While you could use telnet to connect directly to port 995, the thought of attempting SSL key exchange using only the keyboard fills me with all kinds of dread, not to mention the work involved in doing the on-the-fly encryption and decryption of the data stream. [shiver]. No, telnet is a non-starter here.

Turns out there is an easy way. One of openssl's more obscure options (well, it was obscure to me) comes to the rescue.

openssl s_client -connect <server_name>:995

Using the above command will get openssl to setup a secure, interactive, SSL tunnel between your terminal and the server on port 995 (the port normally used for POP3+SSL).

Very useful.

Bookmark/Search this post with:
If you liked this post, buy me a beer.

Comments

16 December, 2010 - 20:00 — Anonymous (not verified)

It works with gmail but it

It works with gmail but it doesn't work with hotmail at pop3.live.com:995

Any idea what is happening?

Thanks a lot.

1 February, 2011 - 11:37 — Anonymous (not verified)

pop3.live.com 995

Yeps, as far as I know that's caused because hotmail uses windows servers (Of course) and the return carriage acts different than in *nix systems.

So you can try adding a parameter to force ssl to use the expected format.

openssl s_client -crlf -connect pop3.live.com:995

As is stated in openssl help:

-crlf - convert LF from terminal into CRLF

I tested it and worked ok, so I hope it's useful for you.

Regards.

1 February, 2011 - 11:41 — Anonymous (not verified)

Ooops, I forgot to mention

Ooops, I forgot to mention that if u use -crlf it still works for gmail too, so the safe option is always use that parameter.

openssl s_client -connect pop.gmail.com:995 <--- Works OK
openssl s_client -crlf -connect pop.gmail.com:995 <--- Works OK
openssl s_client -connect pop3.live.com:995 <--- NOT WORKING!
openssl s_client -crlf -connect pop3.live.com:995 <--- Works OK

13 July, 2010 - 19:46 — Remote Access Software (not verified)

Thanks for the information.

Thanks you for the information. It's really helpful for me though. Key up the good work pal.

24 February, 2010 - 06:42 — joesph22 (not verified)

Depending on how the server

Depending on how the server is configured, you may need to use SSL or TLS before you are able to use the AUTH command. In fact, if you are able to use the AUTH command without using either SSL or TLS, you are in fact sending your userid and password over the internet in clear text. Anybody with a packet revo sunglasses sniffer in the right spot will be able to read the base64-encoded string you send to authenticate, and it's really easy to decode that stuff- in fact the same command above will work if you change "encode_base64" to "decode_base64" (and put the encoded string between the double quotes, obviously.)

17 February, 2010 - 11:42 — Bonn Wafer (not verified)

Thanks for this share. I

Thanks for this share. I will try and see how it works.

6 October, 2009 - 06:32 — Anonymous (not verified)

Superb!!! Thank you! I was

Superb!!! Thank you!
I was trying 2 hours all kind of tools before finding this solution :))

4 July, 2009 - 03:34 — Tanks Game (not verified)

THANKS!

We where having trouble with a script reading yahoo mail (they only allow ssl) so I wanted to test it by hand like regular pop... this saved us like 2 hours I bet.... At least now we know we are really timing out and not having a problem with the script.

Off to check the firewall...

Thanks again.

21 January, 2009 - 22:35 — SilentGreen (not verified)

VERY GOOD!!!

This is moren than great to know.

Are there any commands to send a login password. The command "user" - like used over telnet - works fine, but no further way to list up the emails in the INBOX.

Any idea?

Greetings
SilentGreen

22 January, 2009 - 10:19 — Keith

I think you need to go read

I think you need to go read up on the POP protocol, it is very easy to lean and can be used inside a telnet session.  Google for RFC 1939.

However, to answer your question, there are two POP commands that will let you authenticate and two commands that let you "list up" the mail in the mail box, they are:

  • PASS - use this after the USER command
  • APOP - which may be used instead of a USER/PASS combination as it lets provide the username and an MD5 digest string of the password (and thus prevents the password being sent in the clear)
  • STAT - which will tell you how many messages there are in the mailbox and how many octets they are occupying
  • LIST - will return a list of each message (it's number) and its size in octets

 

Once you know about what messages exist you can then RETR them.

15 November, 2008 - 08:57 — Anonymous (not verified)

Thanks a million!

Thanks a million!

25 September, 2008 - 14:41 — Anonymous (not verified)

Thanks!

This is GREAT to know!!!