0

I have a server with postfix and a plain text authentication.

It accepts both TLS and non-TLS authentication.

How can I force the server to deny all non TLS queries so that the mail users never send their username and passwords in clear text when login in?

To make thinks clear, if [email protected] is the recipient and [email protected] the local sender:

1 Answer 1

3

Because it's New Year's day once more Reading Manuals as a Service.

From the manual

Supporting AUTH over TLS only

Sending AUTH data over an unencrypted channel poses a security risk. When TLS layer encryption is required (smtpd_tls_security_level = encrypt), the Postfix SMTP server will announce and accept AUTH only after the TLS layer has been activated with STARTTLS. When TLS layer encryption is optional (smtpd_tls_security_level = may), it may however still be useful to only offer AUTH when TLS is active. To maintain compatibility with non-TLS clients, the default is to accept AUTH without encryption. In order to change this behavior, set
smtpd_tls_auth_only = yes

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .