Bug 38803 – ucs-test: UCR configuration to disallow plain text passwords over non-TLS connections

Bug 38803 - ucs-test: UCR configuration to disallow plain text passwords over non-TLS connections


Summary:	ucs-test: UCR configuration to disallow plain text passwords over non-TLS con...

Status:	CLOSED FIXED

Product:	UCS Test
Classification:	Unclassified
Component:	Mail
Version:	unspecified
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Ammar Najjar
QA Contact:

URL:
Keywords:

Depends on:	38500
Blocks:
	Show dependency tree / graph

Reported:	2015-07-01 10:02 CEST by Sönke Schwardt-Krummrich
Modified:	2023-03-25 06:49 CET (History)
CC List:	0 users

See Also:
What kind of report is it?:	Development Internal
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sönke Schwardt-Krummrich

2015-07-01 10:02:08 CEST

Please check if plaintext authentication without encrypted connection is disallowed by default and may be configured via UCR for dovecot and cyrus.

+++ This bug was initially created as a clone of Bug #38500 +++

In our Cyrus imapd.conf UCR template the values for "allowplaintext" and "sasl_mech_list" are hard coded.  In order to disallow plain text passwords over non-TLS connections these two options should be set to the following values:
allowplaintext: no (currently yes)
sasl_mech_list: PLAIN (currently the same value)

man 5 imapd.conf reads as follows:
If you only list plaintext authentication mechanisms in ``sasl_mech_list'' and set ``allowplaintext: no'', only users on encrypted sessions (TLS or SSL) will be able to authenticate. On the other hand, if  you  list no plaintext authentication options in ``sasl_mech_list'', ``allowplaintext: yes'' would have no effect.

Comment 1 Ammar Najjar

2015-07-03 09:40:11 CEST

A new test script with the name "40_mail/28_plain_text_passwords_over_nonTLS" to test the mentioned cases.

Tested for dovecot and cyrus.

Comment 2 Stefan Gohmann

2016-10-12 07:48:12 CEST

For this bug is no separate QA needed.