Subject: Use of CRAM-MD5 for AUTH LOGIN or USER/PASS

From: Tom Suhrstedt <[email-masked]>
Date: Fri, 05 May 2000 18:18:22 -0400

I am using a version of the UWash ipop3d daemon that was compiled by
someone else for my Solaris box, but which appears to support CRAM-MD5: 

   +OK POP3 v7.61 server ready <4cc2.39133d3c@localhost>
   AUTH
   +OK Supported authentication mechanisms:
   CRAM-MD5
   LOGIN
   .

Prior to deciding how best to get encrypted authentication for a mix of
UNIX/PC and local/remote users, I wanted to have users start using
something other than their UNIX password to authenticate to the pop3
server. After looking at the md5.txt doc file it appeared to me that if
I created the /etc/cram-md5.pwd file as directed (tab between fields),
then the user would be authenticated against the password in this file
rather than the UNIX password.

   -r--------   1 root     sys          110 May  5 16:51 cram-md5.pwd

My netscape clients do an AUTH LOGIN with base64 encoding, so to
simulate a LOGIN without the encoding I am just doing USER/PASS.
Unfortunately, the cram-md5 password fails, and I must still use my UNIX
password.

   USER me
   +OK User name accepted, password please
   PASS mycrampass
   -ERR Bad login

   USER me
   +OK User name accepted, password please
   PASS myunixpass
   +OK Mailbox open, 1 messages

Thanks in advance to anyone willing to show me the error of my ways.

-- 
Tom Suhrstedt             NASA GSFC Building 32, room N126E
phone: (301) 614-5506     email: [email-masked]
  FAX: (301) 614-5304
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Fri, 5 May 2000 15:41:57 -0700 (PDT)

The cause of your problem is that you have an old version of ipop3d which does
not use the CRAM-MD5 password for non-CRAM-MD5 logins.  This was changed after
your version, so that if CRAM-MD5 is in use the CRAM-MD5 password is always
used for all password-style authentication.

Please upgrade to the lastest version:
	ftp://ftp.cac.washington.edu/mail/imap.tar.Z