Subject: [Imap-uw] uw-imapd login control too coarse

From: "Jan Kuznik" <[email-masked]>
Date: Sat, 18 Jun 2005 00:45:28 +0200 (CEST)

I would like to setup a system running uw-impad and squirrelmail, both
serving my users. In the first case plain text logins need to be disabled
on unencrypted connection, in the second case the opposite is true and the
encryption only unnecessary decreases maximum possible number of users
served (squirrelmail is already secured by https).

I miss a configuration option disabling plain text logins on unencrypted
connections EXCEPT connections from some trusted network.

_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Mark Crispin <[email-masked]>
Date: Fri, 17 Jun 2005 15:58:29 -0700 (Pacific Daylight Time)

> connections EXCEPT connections from some trusted network.

In the main() routine of imap-200?/src/imapd/imapd.c, right after the line 
which reads:
   server_init (pgmname,"imap","imaps",clkint,kodint,hupint,trmint);

insert something like:
#define TRUSTEDNETWORK "105.69."
   if (strncmp (TRUSTEDNETWORK,tcp_clientaddr (),sizeof (TRUSTEDNETWORK))
     mail_parameters (NIL,SET_DISABLEPLAINTEXT,(void *) 0);

Of course, if you're IPv6 or if your network address isn't at an octet 
boundary, you'll need a better test than the strncmp() above.

The important thing is that that mail_parameters() call is how you open up 
plaintext authentication.

The other thing that you may want to consider is work out a way for your 
webmail to pre-authenticate; that is, start imapd already logged in as the 
user.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw