Re: how do disable SASL when compiling imap-2004a?

2004-08-17 Thread Mark Crispin 
On Tue, 17 Aug 2004, ml wrote:
I understand that USER/PASS is insecure.  However, there are [broken]
servers out there which advertise USER and AUTH CRAM-MD5 but in fact
support USER only!  So, when my c-client enabled stuff doesn't work with
such servers, users would complain since their e-mail clients (e.g.
Outlook) would work.
If all you want to do is disable a particular SASL authenticator when it 
is broken on the server, then just do e.g.
	mail_parameters (NIL,DISABLE_AUTHENTICATOR,CRAM-MD5);
to disable CRAM-MD5.

This will still permit the use of other SASL authenticators.  c-client 
will never use USER/PASS unless there are no suitable SASL authenticators.

You should never do this unilaterally; the user should be required to 
configure it.  In particular, note that by default, modern versions of 
good POP3 servers disable the USER/PASS commands.  So it is *NOT* a good 
idea to disable SASL and make a client use USER/PASS by default.  In fact, 
it is a terrible idea.

-- Mark --
http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

Re: how do disable SASL when compiling imap-2004a?

2004-08-16 Thread ml 
On Mon, 16 Aug 2004, Mark Crispin wrote:

On Thu, 29 Jul 2004, ml wrote:
 Is there a way to disable all SASL based authentication when compiling
 imap-2004a?

Sorry for the delay in answering.

The general answer to your question is no; however, you can modify the
source code.

Why do you want to disable SASL authention?  USER/PASS is very insecure
and should not be used.

Mark,

Thanks for the response.  I trust that you have had a good vacation.

I understand that USER/PASS is insecure.  However, there are [broken]
servers out there which advertise USER and AUTH CRAM-MD5 but in fact
support USER only!  So, when my c-client enabled stuff doesn't work with
such servers, users would complain since their e-mail clients (e.g.
Outlook) would work.

Is there a way to force pop3.c to fall back to USER/PASS when CRAM-MD5
fails?

For now, I have hacked pop3.c to make it use USER/PASS only. Thanks.

Cheers,
N.