dovecot - Mar 2014 - Help connecting from remote client (no auth attempts

Blake McBride writes:
> Thanks.  The current version of Thunderbird auto-detects connection
> parameters - presumably by trying every combination.  All I give is an
> email address and a password.  They also have a manual configuration that I
> spent a lot of time with.  I was never able to do any better than their
> auto-config.
That's usually the cause of many problems I see with log entries like yours.
It could happen when client and server disagree on using STARTTLS or SSL,
so hardwiring your client to use whatever your server supports stops the
client from fumbling around (and getting it wrong).
> Given my experience with all this, I feel confident that Thunderbird is not
> a factor in the problem.
A network trace could clear that up, but auto-configure is problematic.
> In terms of the config, I really don't know what I am doing.  I think
what
> I want is clear text passwords sent over an SSL connection.  Isn't that
> secure?  I don't know the difference between SSL and that TTSL thing. 
I
> really don't care how it is setup.  I just want it to be reasonably
secure
> and simple.
You'll need to know these things in order to understand the problem.

The essential difference, as far as your concerned, is that TLS (or
STARTTLS or SSLv(some-number-I-forget)) starts out in plain text,
then the client issues a command (STARTTLS) to commence the secure
(encrypted) communication handshake, whereas SSL dives right in and
expects the client to negotiate SSL parameters immediately.  These two
variations of SSL listen on two distinct ports.  If you get these cross
up, you'll get the above error log.

In my experiments:

 	SSL client -> TLS server port:  Aborted login (no auth attempts)
 	TLS client -> SSL server port: client hangs,
 		Disconnected: Inactivity (no auth attempts in 180 secs)

SSL/TLS + clear-text password is secure.  If you do not use SSL/TLS,
you'll have to use CRAM-MD5 or some challenge-response authentication
to defeat password snooping.  You could use both, but that's overkill.

Joseph Tam <jtam.home at gmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 27 Mar 2014, Joseph Tam wrote:
> Blake McBride writes:
>
>> Thanks.  The current version of Thunderbird auto-detects connection
>> parameters - presumably by trying every combination.  All I give is an
>> email address and a password.  They also have a manual configuration
that I
>> spent a lot of time with.  I was never able to do any better than their
>> auto-config.
>
> That's usually the cause of many problems I see with log entries like
yours.
> It could happen when client and server disagree on using STARTTLS or SSL,
> so hardwiring your client to use whatever your server supports stops the
> client from fumbling around (and getting it wrong).
I have to agree, that automagic stuff fails often.

- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBUzUqK3D1/YhP6VMHAQK6TwgAhFNC2Whe3zI2ElvH58bpVQaS7yw+BsG8
fgTk9RVdbujBfvTl/mEbRWrSz7pfxgxk8P3GufCvOy5Jmasny6RB1bScXQgRMJ1k
MVLvypwW9y/nFn4WELm0CWvwzxMvCIl69vA9Bc+xSyRrbW68iVDxYlrFvf1j95xQ
v/zaHPIRiPHIo7ZUpKg94BAtw/e5uXj/xxjj7/hcWyf4ylHv8NfIMPliIfs1y0Xm
jLoiWx23lrT6HYs76P5MOgnAhTJF6FKOHuJ1Z9qr5KdhwTeIOSdh0Lv/k/zSAI/k
LFP8sH6WAckTilJ8yzR/eM4O5j8hb2uAzn+nj5dmEEoZjvP53h4TVQ==a4fs
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 27 Mar 2014, Joseph Tam wrote:
> Blake McBride writes:
>
>> Thanks.  The current version of Thunderbird auto-detects connection
>> parameters - presumably by trying every combination.  All I give is an
>> email address and a password.  They also have a manual configuration
that I
>> spent a lot of time with.  I was never able to do any better than their
>> auto-config.
>
> That's usually the cause of many problems I see with log entries like
yours.
> It could happen when client and server disagree on using STARTTLS or SSL,
> so hardwiring your client to use whatever your server supports stops the
> client from fumbling around (and getting it wrong).
I have to agree, that automagic stuff fails often.

- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBUzUqK3D1/YhP6VMHAQK6TwgAhFNC2Whe3zI2ElvH58bpVQaS7yw+BsG8
fgTk9RVdbujBfvTl/mEbRWrSz7pfxgxk8P3GufCvOy5Jmasny6RB1bScXQgRMJ1k
MVLvypwW9y/nFn4WELm0CWvwzxMvCIl69vA9Bc+xSyRrbW68iVDxYlrFvf1j95xQ
v/zaHPIRiPHIo7ZUpKg94BAtw/e5uXj/xxjj7/hcWyf4ylHv8NfIMPliIfs1y0Xm
jLoiWx23lrT6HYs76P5MOgnAhTJF6FKOHuJ1Z9qr5KdhwTeIOSdh0Lv/k/zSAI/k
LFP8sH6WAckTilJ8yzR/eM4O5j8hb2uAzn+nj5dmEEoZjvP53h4TVQ==a4fs
-----END PGP SIGNATURE-----