Subject: how do disable SASL when compiling imap-2004a?

From: ml <[email-masked]>
Date: Thu, 29 Jul 2004 23:43:03 +0900 (JST)

Hello!

Is there a way to disable all SASL based authentication when compiling
imap-2004a?

I'm trying to build a simple pop client which uses USER/PASS
authentication only. Currently, it (using src/c-client/pop3.c) defaults to
trying "AUTH CRAM-MD5" when it sees "SASL CRAM-MD5" included in the
response to the "CAPA" command.

Short of hacking pop3.c directly, is there a Makefile option I can change?
I have tried changing:

DEFAULTAUTHENTICATORS=md5 pla log

to

DEFAULTAUTHENTICATORS=

in src/osdep/unix/Makefile but then the compilation would fail.

Many Thanks,

N.
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Mon, 16 Aug 2004 16:36:50 -0700 (Pacific Daylight Time)

> Is there a way to disable all SASL based authentication when compiling

Sorry for the delay in answering.

The general answer to your question is "no"; however, you can modify the 
source code.

Why do you want to disable SASL authention?  USER/PASS is very insecure 
and should not be used.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: ml <[email-masked]>
Date: Tue, 17 Aug 2004 14:27:41 +0900 (JST)

>Why do you want to disable SASL authention?  USER/PASS is very insecure

Mark,

Thanks for the response.  I trust that you have had a good vacation.

I understand that USER/PASS is insecure.  However, there are [broken]
servers out there which advertise "USER" and "AUTH CRAM-MD5" but in fact
support "USER" only!  So, when my c-client enabled stuff doesn't work with
such servers, users would complain since their e-mail clients (e.g.
Outlook) would work.

Is there a way to force pop3.c to fall back to USER/PASS when CRAM-MD5
fails?

For now, I have hacked pop3.c to make it use USER/PASS only. Thanks.

Cheers,
N.

---

From: Mark Crispin <[email-masked]>
Date: Mon, 16 Aug 2004 23:17:49 -0700 (PDT)

> such servers, users would complain since their e-mail clients (e.g.

If all you want to do is disable a particular SASL authenticator when it 
is broken on the server, then just do e.g.
 	mail_parameters (NIL,DISABLE_AUTHENTICATOR,"CRAM-MD5");
to disable CRAM-MD5.

This will still permit the use of other SASL authenticators.  c-client 
will never use USER/PASS unless there are no suitable SASL authenticators.

You should never do this unilaterally; the user should be required to 
configure it.  In particular, note that by default, modern versions of 
good POP3 servers disable the USER/PASS commands.  So it is *NOT* a good 
idea to disable SASL and make a client use USER/PASS by default.  In fact, 
it is a terrible idea.

-- Mark --