Discovery of the day: quick and easy Apple Mail connection tunneling

[kpreid]

I'm on a wireless network which apparently has a firewall which is MITMing port 993 connections (IMAP-over-SSL); my mail client reported a certificate error (the presented certificate was from “FortiGate”). Now, I trust this network's provider, but that doesn't mean I'm going to give them my personal e-mail, much less the password for it; so I went looking for a solution. It turns out that Apple Mail supports SOCKS proxies, and if you have SSH access to another system it's trivial to set up; ssh -D somelocalport somehost, then go into Network Preferences → Advanced → Proxies, and enter localhost:somelocalport as the proxy, and you're done!

It's not clear to me, though, once I set this up how much of my traffic goes over the proxy — the setting is not specific to mail or Apple Mail. This might be testable by shutting down the proxy and seeing what fails.

Comments

[wrog]

actually, SSH port forwarding should be essentially invisible to the applications. I don't see why Apple Mail has to do anything special to support it (i.e., other than not throw conniptions at the idea of an IMAP server listening in a strange place like 127.0.0.2, or being able to connect to SSL-IMAP servers on ports other than 993.

And yes, everybody who talks to 127.0.0.2:993 (or wherever the local side of the tunnel is) gets forwarded the same way; it is indeed not application specific. However if a given application doesn't know about the tunnel, there's pretty much no way it's going to find it on its own, unless you've put it in some standard place like localhost:993, but the only programs that will be using that will be other mail clients, and if you don't have any, you're done.

[kpreid.livejournal.com]

This isn't ssh port forwarding (-L); this is a SOCKS proxy (-D). I would have used a port-forward, but Apple Mail is being half-bakedly clever: it “knows” that a MobileMe (Apple's mail-and-etc service) mail account should be reached at mail.mac.com:993. So I had to do this, avoiding changing the mail config, instead.