| "Ives Stoddard" <[EMAIL PROTECTED]>
Sent by: [EMAIL PROTECTED] 06/19/2003 01:57 AM
|
To: <[EMAIL PROTECTED]> cc: Subject: Re: [IMail Forum] Change Password Feature |
Joe,
Look into ASP/ASPX scripting that will allow you to set passwords from a page on an IIS server. I recommend checking for and preventing any user that is in a group that has higher-than-normal access rights in your NT/AD domain from changing their password over the web-page. If you use a web-page to do this you really MUST be running SSL on the web server to prevent NT/AD passwords being sent in plain-text.
>> i understand the security risks involved whilst having plain text traversing over the net. i'll definitely investigate
>> asp scripting running ssl. as stated earlier - i'm just the messenger - our manager is looking at maintaining certain services.
>> thx for your advice ives. new possibilities await :o)
Even if you decided to use a different authentication method for IMail (IMail DB or external SQL DB), with an IMail -> NT/AD sync tool, you would still want to ensure only SSL access from the internet since POP, IMAP, SMTP auth, and HTTP will all send passwords in plain-text (unless using SSL). This prevents email users from inadvertently giving away their NT/AD passwords over the internet. If you are unable to implement SSL, you should consider an alternative to having password synchronization, like keeping one set of passwords for NT and another for email (making sure they're not the same).
-ives
