Subject: PASSWDTYPE=nul allows "login" authentication

From: Dave Sill <[email-masked]>
Date: Tue, 15 Feb 2000 14:40:33 -0500 (EST)

[imap 4.7a under Solaris 7, GCC]

Did:

  make clean
  make gso PASSWDTYPE=nul

imapd allows "login" authentication, which, according to docs/md5.txt, 
it shouldn't.

Question: has anyone here built 4.7a with PASSWDTYPE=nul and verified
that plaintext logins are disallowed?

-Dave
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Tue, 15 Feb 2000 15:51:02 -0800 (PST)

> imapd allows "login" authentication, which, according to docs/md5.txt,

It is a known problem in imap-4.[] that there is continued availability of
plaintext authentication in spite of PASSWDTYPE=nul when an CRAM-MD5 password
database exists.

This problem was not discovered until after the release of imap-4.7a.

It will be fixed in imap-2000.

---

From: [email-masked]
Date: Wed, 16 Feb 2000 12:49:40 -0600 (CST)

Please don't do an IMAP-2000!,  do Imap 4.8 or 5.0 instead..

Bill Suetholz