Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1148803 > unrolled thread
| Started by | Dominic Preston <lzqhwo@gmail.com> |
|---|---|
| First post | 2023-06-05 16:20 +0200 |
| Last post | 2023-06-06 11:20 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.debian.bugs.dist
Bug#1037127: exim4-config: Example Dovecot authenticator for Exim allows plaintext non TLS AUTH by default Dominic Preston <lzqhwo@gmail.com> - 2023-06-05 16:20 +0200
Bug#1037127: exim4-config: Example Dovecot authenticator for Exim allows plaintext non TLS AUTH by default Marc Haber <mh+debian-packages@zugschlus.de> - 2023-06-06 11:20 +0200
| From | Dominic Preston <lzqhwo@gmail.com> |
|---|---|
| Date | 2023-06-05 16:20 +0200 |
| Subject | Bug#1037127: exim4-config: Example Dovecot authenticator for Exim allows plaintext non TLS AUTH by default |
| Message-ID | <GDjdU-dQCA-1@gated-at.bofh.it> |
Package: exim4-config
Version: 4.94.2-7
Severity: normal
X-Debbugs-Cc: lzqhwo@gmail.com
In Debian unstable exim4.conf.template, the example authenticator for
Dovecot, dovecot_plain_server, does not enforce TLS security for plaintext
authentication by default.
The Exim config should be changed to only advertise AUTH if the connection
is encrypted, in line with the other plain text authenticators, by adding
the final three lines below:
# dovecot_plain_server:
# driver = dovecot
# public_name = PLAIN
# server_socket = /var/spool/exim4/dovecot.auth-client
# server_set_id = $auth1
# .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
# server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
# .endif
[toc] | [next] | [standalone]
| From | Marc Haber <mh+debian-packages@zugschlus.de> |
|---|---|
| Date | 2023-06-06 11:20 +0200 |
| Message-ID | <GDB17-e1C4-1@gated-at.bofh.it> |
| In reply to | #1148803 |
On Mon, Jun 05, 2023 at 02:08:22PM +0000, Dominic Preston wrote: > The Exim config should be changed to only advertise AUTH if the connection > is encrypted, in line with the other plain text authenticators, by adding > the final three lines below: I made that MR #9. Greetings Marc -- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402 Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.dist
csiph-web