dovecot - Jan 2019 - [solved] managesieve configuration

Op 13/01/2019 om 00:22 schreef Dominik Menke:
>> For reference: if you put ssl=yes there, the TLS layer is established 
>> immediately. However, the standard ManageSieve protocol does not 
>> support that (not currently anyway): only the establishment of the 
>> TLS layer using the STARTTLS command is part of the standard. That is 
>> why your clients fail to connect: they're speaking plaintext while 
>> the server is speaking TLS. Still, Dovecot supports configuring it 
>> that way, which is what you did.
>>
>> Regards,
>>
>> Stephan.
>>
>>
>
>
> I'm just surprised that ssl=yes leads to STARTTLS being disabled, as 
> per the wiki [1]:
With ssl=yes, the TLS layer is enabled immediately on the connection. 
So, there is no need to perform STARTTLS. But worse, a client that 
doesn't work this way will try to send "STARTTLS" in plaintext to
a
service talking TLS already. This will obviously not work.

Regards,

Stephan.
>
>
> > ssl=yes and disable_plaintext_auth=no: SSL/TLS is offered to the
> > client, but the client isn't required to use it. [...]
> >
> > ssl=yes and disable_plaintext_auth=yes: SSL/TLS is offered to the
> > client, but the client isn't required to use it. [...]
> >
> > ssl=required: SSL/TLS is always required [...]. Any attempt to
> > authenticate before SSL/TLS is enabled will cause an authentication
> > failure.
>
>
> Maybe this bit needs to be clarified a bit? I think I've read that 
> page a few times and it still didn't occur to me that this could be a 
> problem.
>
> Best regards,
> --Dominik
>
>
> [1]: https://wiki.dovecot.org/SSL/DovecotConfiguration

On 1/13/19 12:23 PM, Stephan Bosch wrote:
> With ssl=yes, the TLS layer is enabled immediately on the connection. 

Again, that's not what the documentation says:

     ssl=yes [...]: SSL/TLS is offered to the client, but the client
     isn't required to use it.

If the client is not _required_ to use it, it _may_ chose plaintext 
transport, no?

(I'm not here to argue, I'm just pointing out an issue with the wiki).


--Dominik

Op 14-1-2019 om 9:58 schreef Dominik Menke:
> On 1/13/19 12:23 PM, Stephan Bosch wrote:
>> With ssl=yes, the TLS layer is enabled immediately on the connection. 
>
>
> Again, that's not what the documentation says:
>
> ??? ssl=yes [...]: SSL/TLS is offered to the client, but the client
> ??? isn't required to use it.
>
> If the client is not _required_ to use it, it _may_ chose plaintext 
> transport, no?
>
> (I'm not here to argue, I'm just pointing out an issue with the
wiki).
Oh, I think we are talking about different things here. You're talking 
about the global ssl= setting. I am talking about the ssl = yes inside 
the service listener configuration 
(https://wiki.dovecot.org/Services#inet_listeners). The former specifies 
whether SSL is available/required for user connections in general, 
whereas the latter specifies whether the service activates the TLS layer 
immediately for that particular listener. The latter is also where you 
made the configuration mistake.


Regards,

Stephan