-2

i'm going to setup mail server according this guide : https://workaround.org/ispmail/wheezy

on setting up dovecot part 10-auth.conf

it's says change auth_mechanisms = plain to auth_mechanisms = plain login

and it's also say's : By default Dovecot sets "disable_plaintext_auth = yes" which ensures that every connection is encrypted using TLS.

but on my 10-auth.conf file disable_plaintext_auth = yes is commented like : #disable_plaintext_auth = yes

should i uncomment it ?

Improve this question
1
  • That depends. Do you want every connection to be encrypted with TLS? You need to understand the purpose of these options if you're going to configure the server.
    – Andrew Schulman
    Sep 6, 2014 at 0:35

1 Answer 1

Reset to default
0

It's depends. Plaintext authorization is unsafe over the outer networks where traffic can be sniffed. When auth performed over TLS connection then plaintext is ok. Also it's ok when auth take place locally on the same host. dovecot have neat option that allow to restrict plaintext auth over the foreign networks.

local AAA.BBB.CCC.DDD {
  ssl = required
}

All incoming connections via the interface with specified IP-address will be rejected if they are not SSL/TLS-encrypted.

Improve this answer
3
  • if i use auth_mechanisms = plain login and mysql and dovecot is on same server , i should uncomment #disable_plaintext_auth = yes or not
    – syntaxerro
    Aug 8, 2014 at 6:15
  • Docs ( wiki2.dovecot.org/SSL/DovecotConfiguration ) says: "Note that plaintext authentication is always allowed (and SSL not required) for connections from localhost, as they're assumed to be secure anyway. This applies to all connections where the local and the remote IP addresses are equal." Therefore you can leave the string commented as far it is implied by default.
    – Kondybas
    Aug 8, 2014 at 10:53
  • But I'm still insist to define explicitly that all connections from outer space should be secured by SSL/TLS. Proposed config block is equivalent to the exim's option tls_on_connect_ports. At least you will be protected from the password bruteforsing, cause no auth will be allowed before SSL/TLS.
    – Kondybas
    Aug 8, 2014 at 11:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .