qazmlp writes: >>> - SASL auth. also does not help. (I'm not sure here!) >> >> Yes it does. The DIGEST-MD5 mechanism for example. It supports a >> security layer (just like TLS), but that's optional. > > Here, do you mean that the SASL mechanism can fulfill my requirement of > sending only the password in encrypted and other data in non-encrypted > form?
Yup. But I should have mentioned that the DIGEST-MD5 mechanism does have problems. So check out which SASL mechanisms both your client and server support. I'm not up to date on SASL mechanisms, hopefully someone else here is. Common examples: ANONYMOUS, PLAIN and LOGIN do you no good. Nor EXTERNAL I think, it uses credentials sent by other means, e.g. a TLS client certificate or (for OpenLDAP ldapi:// unix domain sockets on the same machine) the client process' uid/gid. I think CRAM-MD5 is not as good as DIGEST-MD5, except its implementation is easier and thus less likely to be buggy. There are some newer methods, but I don't know how they are doing. -- Regards, Hallvard --- You are currently subscribed to [email protected] as: [EMAIL PROTECTED] To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the SUBJECT of the message.
