[gentoo-user] OT - Dovecot and authentication

[gentoo-user] OT - Dovecot and authentication

[Michael Sullivan]

I've got a problem; My Dovecot installation uses plain text
authentication.  I don't like the idea of unencrypted passwords being
sent over the Internet, so I want to switch to a different
authentication method.  I'm mainly worried about my webmail client.  I
configured Apache last week for SSL access to the webmail client
(Squirrelmail), but my Windows users have been saying that they haven't
been able to access Squirrelmail since last week before I converted it
to SSL.  I tried it myself in Windows.  Windows said it couldn't even
find my domain.  After I turned off the SSL, Windows found it.  I need
something else.  The Dovecot wiki mentions several other authentication
methods (cram-md5 looks promising), but it doesn't say how to set up a
cram-md5 database.  Can anyone direct me on how to do this?

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] OT - Dovecot and authentication

[Michael Sullivan]

On Wed, 2006-07-19 at 16:07 +0100, Neil Bothwick wrote:
> On Wed, 19 Jul 2006 09:52:40 -0500, Michael Sullivan wrote:
> 
> > I've got a problem; My Dovecot installation uses plain text
> > authentication.  I don't like the idea of unencrypted passwords being
> > sent over the Internet, so I want to switch to a different
> > authentication method.  I'm mainly worried about my webmail client.  I
> > configured Apache last week for SSL access to the webmail client
> > (Squirrelmail),
> 
> Are SquirrelMail and Dovecot running on the same box? If so, the
> unencrypted passwords are only being used within that box, between
> SquirrelMail and Dovecot.
> 
> > but my Windows users have been saying that they haven't
> > been able to access Squirrelmail since last week before I converted it
> > to SSL.
> 
> You need to fix the SSL/Windows/SquirrelMail problem, otherwise your
> users will be sending plain text passwords across the Internet, no matter
> how SquirrelMail communicates with Dovecot.

What problem?  I could connect to Squirrelmail just fine from Seamonkey in Linux.  The problem is Windows.  I don't do Windows.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] OT - Dovecot and authentication

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 996 bytes --]

On Wed, 19 Jul 2006 10:49:44 -0500, Michael Sullivan wrote:

> > You need to fix the SSL/Windows/SquirrelMail problem, otherwise your
> > users will be sending plain text passwords across the Internet, no
> > matter how SquirrelMail communicates with Dovecot.
> 
> What problem?  I could connect to Squirrelmail just fine from Seamonkey
> in Linux.  The problem is Windows.  I don't do Windows.

If you run a server that will be accessed from Windows, you are "doing"
Windows and have to fix the problem. Otherwise, no matter how secure the
communication between SquirrelMail and Dovecot, your users' passwords will
be transmitted over the net in plain text.

I've just tried to connect to SquirrelMail over HTTPS from a default
XP+SP2 installation and it worked fine. Unless all your users have
identically misconfigured/broken computers, the fault is likely to be in
your Apache or  SquirrelMail configuration.


-- 
Neil Bothwick

IRQs? We don't need no stinking IRQs!

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] OT - Dovecot and authentication

[kashani]

Michael Sullivan wrote:
> I've got a problem; My Dovecot installation uses plain text
> authentication.  I don't like the idea of unencrypted passwords being
> sent over the Internet, so I want to switch to a different
> authentication method.  I'm mainly worried about my webmail client.  I
> configured Apache last week for SSL access to the webmail client
> (Squirrelmail), but my Windows users have been saying that they haven't
> been able to access Squirrelmail since last week before I converted it
> to SSL.  I tried it myself in Windows.  Windows said it couldn't even
> find my domain.  After I turned off the SSL, Windows found it.  I need
> something else.  The Dovecot wiki mentions several other authentication
> methods (cram-md5 looks promising), but it doesn't say how to set up a
> cram-md5 database.  Can anyone direct me on how to do this?
> 

Do you have a real SSL cert and if so was it from a cheap provider? In 
many case the SSL root cert for that provider is not within IE which can 
break things. The fix is to add that particular SSL cert providers 
intermediate.crt. It's probably somewhere on their site along with 
directions on how to add it to Apache.

kashani
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] OT - Dovecot and authentication

[Michael Sullivan]

On Wed, 2006-07-19 at 10:53 -0700, kashani wrote:
> Michael Sullivan wrote:
> > I've got a problem; My Dovecot installation uses plain text
> > authentication.  I don't like the idea of unencrypted passwords being
> > sent over the Internet, so I want to switch to a different
> > authentication method.  I'm mainly worried about my webmail client.  I
> > configured Apache last week for SSL access to the webmail client
> > (Squirrelmail), but my Windows users have been saying that they haven't
> > been able to access Squirrelmail since last week before I converted it
> > to SSL.  I tried it myself in Windows.  Windows said it couldn't even
> > find my domain.  After I turned off the SSL, Windows found it.  I need
> > something else.  The Dovecot wiki mentions several other authentication
> > methods (cram-md5 looks promising), but it doesn't say how to set up a
> > cram-md5 database.  Can anyone direct me on how to do this?
> > 
> 
> Do you have a real SSL cert and if so was it from a cheap provider? In 
> many case the SSL root cert for that provider is not within IE which can 
> break things. The fix is to add that particular SSL cert providers 
> intermediate.crt. It's probably somewhere on their site along with 
> directions on how to add it to Apache.
> 
> kashani

I'm using a self-signed certificate.

-- 
gentoo-user@gentoo.org mailing list