Re: FW: Authentication issues

2013-08-24 Thread /dev/rob0
On Sat, Aug 24, 2013 at 10:01:08AM -0400, David Hulsebus wrote: Noel: > > Probably better is to only offer AUTH on submission port 587 > > with required encryption, and not offer AUTH at all on port 25. > > That is exactly what I want to do. If I uncomment this in the > master.cf does it force T

Re: FW: Authentication issues

2013-08-24 Thread Wietse Venema
David Hulsebus: > > Probably better is to only offer AUTH on submission port 587 with > > required encryption, and not offer AUTH at all on port 25. > > That is exactly what I want to do. If I uncomment this in the master.cf does > it force TLS encryption on port 587 before authentication? If not

RE: FW: Authentication issues

2013-08-24 Thread David Hulsebus
> Probably better is to only offer AUTH on submission port 587 with > required encryption, and not offer AUTH at all on port 25. That is exactly what I want to do. If I uncomment this in the master.cf does it force TLS encryption on port 587 before authentication? If not, how would I do that? su

Re: FW: Authentication issues

2013-08-23 Thread Noel Jones
On 8/23/2013 9:35 PM, David Hulsebus wrote: > > When I added "noplaintext" as a security option and because MD5 was in the > mech list SASL complained about no auth mechanism when it started. MD5 was > already in the mech list but never failed because auth never reached it in > the past, plain too

Re: FW: Authentication issues

2013-08-23 Thread Manuel Bieling
On 08/24/2013 04:35 AM, David Hulsebus wrote: Why shouldn't I require TLS to encrypt all sessions for any clients who authenticates to send mail out. Isn't that what following parameter accomplishes ? smtpd_tls_security_level = encrypt The manual says "Encrypt - MUST NOT be applied in case of a

FW: Authentication issues

2013-08-23 Thread David Hulsebus
When I added "noplaintext" as a security option and because MD5 was in the mech list SASL complained about no auth mechanism when it started. MD5 was already in the mech list but never failed because auth never reached it in the past, plain took precedence. I removed "noplaintext" and removed eve

Re: Authentication issues

2013-08-23 Thread Scott Kitterman
On Friday, August 23, 2013 15:38:38 David Hulsebus wrote: > I apologize in advance for the long post. I started working for a small ISP > with around 3000 mailboxes and inherited a Postfix server that I've been > auditing. It's based on Ubuntu 8.04 LTS, Postfix 2.51, and runs Courier for > pop and

Re: Authentication issues

2013-08-23 Thread DTNX Postmaster
On Aug 23, 2013, at 21:38, David Hulsebus wrote: > I apologize in advance for the long post. I started working for a small ISP > with around 3000 mailboxes and inherited a Postfix server that I've been > auditing. It's based on Ubuntu 8.04 LTS, Postfix 2.51, and runs Courier for > pop and imap a

Re: Authentication issues

2013-08-23 Thread Wietse Venema
David Hulsebus: > But without the ability to use CRAM-MD5, DIGEST-MD5, NTLM, how can > I use TLS to make the connection and authorize the clients? TLS (formerly known as SSL) encrypts the SMTP session. This uses the STARTTLS command. SASL authenticates the user. This uses the AUTH command. With

Authentication issues

2013-08-23 Thread David Hulsebus
I apologize in advance for the long post. I started working for a small ISP with around 3000 mailboxes and inherited a Postfix server that I've been auditing. It's based on Ubuntu 8.04 LTS, Postfix 2.51, and runs Courier for pop and imap authentication. It has encrypted passwords in a MySQL databa