Hi all,
Ok, up until now, I've only always allowed IMAPS connections to dovecot
on port 993.
I want to also start allowing clients to user port143+STARTTLS, but I
walso want to make sure both ports are locked down to ONLY allow secure
connections.
So... is disable_plaintext_auth = yes in the main config enough to
accomplish this?
http://wiki2.dovecot.org/SSL/DovecotConfiguration says:
There are a couple of different ways to specify when SSL/TLS is required:
*
disable_plaintext_auth=yes allows plaintext authentication
<http://wiki2.dovecot.org/Authentication/Mechanisms> only when
SSL/TLS is used first.
*
ssl = required requires SSL/TLS also for non-plaintext
authentication <http://wiki2.dovecot.org/Authentication/Mechanisms>.
*
If you have only plaintext mechanisms enabled
(auth { mechanisms = plain login } ), you can use either (or both)
of the above settings. They behave exactly the same way then
and the comments in 10-auth.conf say:
# Disable LOGIN command and all other plaintext authentications unless
# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
# matches the local IP (ie. you're connecting from the same computer), the
# connection is considered secure and plaintext authentication is allowed.
# See also ssl=required setting.
#disable_plaintext_auth = yes
These seem to be saying that all I need to do is set either or both
(ssl-required and/or disable_plaintext_auth=yes).
I'm looking for the simplest, and don't like redundant/unnecessary
settings, so... which is the best/preferred way?
And what is the difference between ssl=required and
disable_plaintext_auth=yes?
Thanks,
--
Best regards,
*/Charles/***
