dovecot - Sep 2014 - Master user and non-plaintext auth does not work

Hi,

I want to use CRAM-MD5 or DIGEST-MD5 (non-plaintext) authentication
for master users, but Dovecot 2.2.13 rejects it with the following log:

  Sep  1 06:18:08 localhost dovecot: auth:
passwd-file(masteruser,10.0.1.20,master,<ZA1s9/oBgAAKAAEU>): Master user
logging in as u0001
  Sep  1 06:18:08 localhost dovecot: auth: cram-md5(u0001 at
example.jp,10.0.1.20,<ZA1s9/oBgAAKAAEU>): password mismatch
  Sep  1 06:18:10 localhost dovecot: imap-login: Disconnected (auth failed, 1
attempts in 2 secs): user=<u0001 at example.jp>, method=CRAM-MD5,
rip=10.0.1.20, lip=10.0.103.100, secured, session=<ZA1s9/oBgAAKAAEU>

PLAIN and LOGIN are OK:

  Sep  1 06:20:34 localhost dovecot: auth:
passwd-file(masteruser,10.0.1.20,master,<SpwmAPsBgwAKAAEU>): Master user
logging in as u0001
  Sep  1 06:20:34 localhost dovecot: imap-login: Login: user=<u0001 at
example.jp>, method=PLAIN, rip=10.0.1.20, lip=10.0.103.100, mpid=23743,
secured, session=<SpwmAPsBgwAKAAEU>
  Sep  1 06:20:34 localhost dovecot: imap(u0001 at example.jp):
SpwmAPsBgwAKAAEU: Connection closed in=13 out=663

I have the following configuration in my dovecot.conf:

  auth_mechanisms = plain login cram-md5 digest-md5
  disable_plaintext_auth = yes
  auth_master_user_separator = %

  passdb {
    driver = passwd-file
    args = /etc/dovecot/passwd.masterusers
    master = yes
    pass = yes
  }

  # don't work too
  #passdb {
  #  driver = checkpassword
  #  args = /opt/osstech/etc/dovecot/checkpassword.masterusers
  #  master = yes
  #  pass = yes
  #}

  passdb {
    driver = ldap
    args = /etc/dovecot/dovecot-ldap.conf.ext
  }

Is this a bug or a restriction of Dovecot?

-- 
-- Name: SATOH Fumiyasu @ OSS Technology Corp. (fumiyas @ osstech co jp)
-- Business Home: http://www.OSSTech.co.jp/
-- GitHub Home: https://GitHub.com/fumiyas/
-- PGP Fingerprint: BBE1 A1C9 525A 292E 6729  CDEC ADC2 9DCA 5E1C CBCA

Quoting SATOH Fumiyasu <fumiyas at osstech.jp>:
> I want to use CRAM-MD5 or DIGEST-MD5 (non-plaintext) authentication
> for master users, but Dovecot 2.2.13 rejects it with the following log:
>
>   auth_mechanisms = plain login cram-md5 digest-md5
>   disable_plaintext_auth = yes
>   auth_master_user_separator = %
>
>   passdb {
>     driver = passwd-file
>     args = /etc/dovecot/passwd.masterusers
>     master = yes
>     pass = yes
>   }
>
>   # don't work too
>   #passdb {
>   #  driver = checkpassword
>   #  args = /opt/osstech/etc/dovecot/checkpassword.masterusers
>   #  master = yes
>   #  pass = yes
>   #}
>
>   passdb {
>     driver = ldap
>     args = /etc/dovecot/dovecot-ldap.conf.ext
>   }
>
> Is this a bug or a restriction of Dovecot?
This is a restriction of CRAM-MD5 and DIGEST-MD5
They require plaintext passwords, you can't use password hashes on the  
server if you wish to use them. Or you have to use the special  
cram/digest-md5 password hash format.

There is nothing really to be gained from using these formats, it's  
just better to require TLS.