Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1148803
| From | Dominic Preston <lzqhwo@gmail.com> |
|---|---|
| Newsgroups | linux.debian.bugs.dist |
| Subject | Bug#1037127: exim4-config: Example Dovecot authenticator for Exim allows plaintext non TLS AUTH by default |
| Date | 2023-06-05 16:20 +0200 |
| Message-ID | <GDjdU-dQCA-1@gated-at.bofh.it> (permalink) |
| Organization | linux.* mail to news gateway |
Package: exim4-config
Version: 4.94.2-7
Severity: normal
X-Debbugs-Cc: lzqhwo@gmail.com
In Debian unstable exim4.conf.template, the example authenticator for
Dovecot, dovecot_plain_server, does not enforce TLS security for plaintext
authentication by default.
The Exim config should be changed to only advertise AUTH if the connection
is encrypted, in line with the other plain text authenticators, by adding
the final three lines below:
# dovecot_plain_server:
# driver = dovecot
# public_name = PLAIN
# server_socket = /var/spool/exim4/dovecot.auth-client
# server_set_id = $auth1
# .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
# server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}
# .endif
Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread
Bug#1037127: exim4-config: Example Dovecot authenticator for Exim allows plaintext non TLS AUTH by default Dominic Preston <lzqhwo@gmail.com> - 2023-06-05 16:20 +0200 Bug#1037127: exim4-config: Example Dovecot authenticator for Exim allows plaintext non TLS AUTH by default Marc Haber <mh+debian-packages@zugschlus.de> - 2023-06-06 11:20 +0200
csiph-web