similar to: CRAM-MD5 authentication memory leak problem.

Hello all. Im try to make a SMTP Auth using Docecot SASL. Im use swaks for tests. Im store users in LDAP. As im understand for CRAM & DIGEST MD5 we need to store pass in a clear text?... Ok. mail: admin3 at domain.off userPassword: 123 <- Clear text What im do %swaks -a CRAM-MD5 -au admin3 at domain.off -ap 123 To: admin3 at domain.off === Trying mx.domain.off:25... === Connected to

/etc/dovecot.conf: auth default { mechanisms=plain login cram-md5 passdb { #.............. Windows Live Mail: CRAM-MD5 authentication failed. This could be due to a lack of memory on your system. Your IMAP command could not be sent to the server, due to non-network errors. This could, for example, indicate a lack of memory on your system. Configuration: Account: Sheltoncomputers

Hi all, Got a question on configuring dovecot, I'm still new at this so I might be doing this all wrong. I want dovecot to authenticate the mail client using CRAM-MD5 so I've setup the config in dovecot.conf: auth default { mechanisms = cram-md5 passdb sql { # Path for SQL configuration file, see doc/dovecot-sql-example.conf args = /etc/dovecot/dovecot-sql.conf

We have a plethora of accounts for which we would like to enable CRAM-MD5 but their passwords are stored as MD5 hashes. Is there anything we can do? Can we take a linux MD5 hashed password (e.g. $1$fac330ee$wd6Tll...) and convert it to dovecot's CRAM-MD5 format (e.g. {CRAM-MD5}b3f297...)? Thanks!

After upgrading my dovecot installation about a month ago, I have started seeing "Requested CRAM-MD5 scheme, but we have only MD5-CRYPT" message from dovecot in my logs. Any help in finding and correcting the cause will be greatly appreciated. --Richard

On 12/5/14, ML mail <mlnospam at yahoo.com> wrote: > Hello, > > I am wondering which variant is more secure for user authentication and > password scheme. Basically I am looking at both variants: > > 1) MD5-CRYPT password scheme storage with CRAM-MD5 auth mechanism > 2) SHA512-CRYPT password scheme storage with PLAIN auth mechanism > > In my opinion the option 2)

Hi, based on the recent discussion by Bill Cole and Douglas Willcocks I've quickly put together a PHP script which generates MD5 'contexts' for Dovecot's password files: http://www.noerenberg.de/hajo/pub/dovecot_hmacmd5.php.txt The script has not been tested extensively, so use it on your own risk :) Most of the code has been shamelessly stolen from various sources.

Am 06.12.2014 um 06:56 schrieb Jan Wide?: > If you add disable_plaintext_auth=yes ssl=required settings, then > dovecot will drop authentication without STARTTLS. But damage will be > done, client will send unencrypted (or in this scenario MD5 or SHA512 > hash) login/password no, damage will *not* be done STARTTLS happens in context of connect and *log before* any authentication is

Hello, I am wondering which variant is more secure for user authentication and password scheme. Basically I am looking at both variants: 1) MD5-CRYPT password scheme storage with CRAM-MD5 auth mechanism 2) SHA512-CRYPT password scheme storage with PLAIN auth mechanism In my opinion the option 2) should be safer although it is using PLAIN auth mechanism. Of course I would always use STARTTLS and

Am 6. Dezember 2014 13:10:58 MEZ, schrieb Reindl Harald <h.reindl at thelounge.net>: > >Am 06.12.2014 um 06:56 schrieb Jan Wide?: >> If you add disable_plaintext_auth=yes ssl=required settings, then >> dovecot will drop authentication without STARTTLS. But damage will be >> done, client will send unencrypted (or in this scenario MD5 or SHA512 >> hash)

Le 20/06/2019 ? 12:25, @lbutlr via dovecot a ?crit?: > On 20 Jun 2019, at 04:14, Jorge Bastos via dovecot <dovecot at dovecot.org> wrote: >> I don't desagree with your vision, but if the use of CRAM-XXXX has to use >> plaint text password's on the server there's a dark side, or there's a >> CRAM-XXX that can use encrypted on server side? There's

On 31.01.2017 09:06, Poliman - Serwis wrote: > I set up cram-md5 using this tutorial > https://wiki2.dovecot.org/HowTo/CRAM-MD5 in /etc/dovecot/dovecot.conf in > passdb code block: > listen = *,[::] > protocols = imap pop3 > #auth_mechanisms = plain login cram-md5 > auth_mechanisms = cram-md5 plain login > #dodana nizej linia > ssl = required > disable_plaintext_auth

hello dovecot community, question; if my user database and dovecot installation is currently setup to use plain login passwords, and i want to convert to cram-md5, after i configure dovecot accordingly and reset passwords into cram-md5, if anyone uses plain login method again in the future, will it still work? or must they always from this point on use encrypted passwords? Thanks. -- Thanks,

Howdy, Answering all, so cram-md5 is old, don't want then! I only noticed thunderbird as default using this, so, won't implement it! Thanks for the clarify, -----Original Message----- From: dovecot <dovecot-bounces at dovecot.org> On Behalf Of Aki Tuomi via dovecot Sent: 19 de junho de 2019 07:31 To: Alexander Dalloz <ad+lists at uni-x.org>; dovecot at dovecot.org Subject:

Hi Emanuel, I understand what you said. Users have access to SSL and TLS so it's fine, it's their options to use or not. Thanks for the help from all, -----Original Message----- From: dovecot <dovecot-bounces at dovecot.org> On Behalf Of FUSTE Emmanuel via dovecot Sent: Thursday, June 20, 2019 9:53 To: dovecot at dovecot.org Subject: Re: Help on CRAM-MD5 Hello, The world is not

On Tue, 18 Jun 2019 16:41:06 -0600 "@lbutlr via dovecot" <dovecot at dovecot.org> wrote: > What is the reason for wanting to enable CRAM-MD5? That was intended > to use on unsecured connections; you should not be allowing > authentication on unsecured connections in 2019. > > Establish a secure submission on port 587 or smtps on 465 and do not > use CRAM-MD5 at

On 12/06/2014 02:35 AM, Nick Edwards wrote: > On 12/5/14, ML mail <mlnospam at yahoo.com> wrote: >> Hello, >> >> I am wondering which variant is more secure for user authentication and >> password scheme. Basically I am looking at both variants: >> >> 1) MD5-CRYPT password scheme storage with CRAM-MD5 auth mechanism >> 2) SHA512-CRYPT password

I don't desagree with your vision, but if the use of CRAM-XXXX has to use plaint text password's on the server there's a dark side, or there's a CRAM-XXX that can use encrypted on server side? There's always the thing that can clients don't support it. I think i'm not wrong with what i said, On 20 Jun 2019, at 02:53, FUSTE Emmanuel via dovecot <dovecot at

On 17.11.2016 10:30, Arkadiusz Mi?kiewicz wrote: > On Thursday 17 of November 2016, Aki Tuomi wrote: >> On 17.11.2016 10:14, Arkadiusz Mi?kiewicz wrote: >>> Hello. >>> >>> dovecot 2.2.26.0 >>> >>> When testing nopassword extra field >>> (http://wiki2.dovecot.org/PasswordDatabase/ExtraFields) with CRAM-MD5 >>> dovecot

Hi Timo, Mozilla 1.5 doesn't understand DIGEST-MD5; it only speaks CRAM-MD5 or PLAIN. Maybe other clients have the same problem. My users like Mozilla, so I wrote new code for Dovecot to speak CRAM-MD5, using your mech-digest-md5.c as a reference. Attached diff in two formats i) for current CVS ii) against last release both tested and working with Mozilla and KMail's CRAM-MD5. I