Re: Preventing Plain Auth

Aki Tuomi via dovecot said on Fri, 6 Mar 2026 11:58:56 +0200 (EET)

>> On 06/03/2026 01:04 EET Steve Litt via dovecot <[email protected]>
>> wrote:
>> 
>>  
>> Hi all,
>> 
>> https://doc.dovecot.org/2.4.2/core/summaries/settings.html , the
>> auth_allow_cleartext section, says "If no, disables the LOGIN command
>> and all other cleartext authentication unless SSL/TLS is used
>> (LOGINDISABLED capability) or the connection is secured (see ssl).
>> 
>> See SSL configuration for more detailed explanation of how this
>> setting interacts with the ssl setting.
>> 
>> This setting replaces the disable_plaintext_auth setting."
>> 
>> I put auth_allow_cleartext = no in my 2.4.2 dovecot.conf, but my
>> Claws-Mail client can still access it, even though there are no key
>> files. I tried putting this setting in several different places:
>> Didn't prevent plain access. I tried switching from 127.0.0.1 to
>> 10.0.2.15, same problem. The following is the output of my dovecot
>> -n command: 
>
>Hi, auth_allow_cleartext=no is the default setting.
>
>However, as
>https://doc.dovecot.org/2.4.2/core/config/ssl.html#secured-connections
>states, connections from login_trusted_networks or from the host
>listener itself (in your case 10.0.2.15) are considered trusted, so
>they are allowed to use plaintext login.
>
>So basically set ssl=required

Thanks Aki,

I've seen no documentation indicating *where* ssl=required should go,
and so had to experiment. If I go 2.3x style and put it within imaps:

listen = 10.0.2.15
auth_allow_cleartext = no

# The IMAP service declarations
service imap {
  #Plain text listener at port 143
  #inet_listener imap-login {
  #port = 0
  #}
#  SSL IMAP (imaps) is port 993
  inet_listener imaps {
    #port = 993
    ssl = required
  }
}

With the preceding config, the following error occurs:

[root@dovecotvoid dovecot]# dovecot -F
doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf
line 29: ssl: Invalid boolean value: required (use yes or no)
[root@dovecotvoid dovecot]#

If I move the ssl=required right below auth_allow_cleartext = no, or
right below service imap { , then with or without ssl=yes inside
inet_listener imaps { , dovecot -F runs, but Dovecot's accessible
without SSL.

Let me explain my goal and what I'm doing. My goal is to reject any
plain text, non-SSL queries from anyone anywhere, full stop. Basically,
what ssl=required inside inet_listener imaps gave us in 2.3x. I'm
using a Qemu VM guest to test 2.4.2 config before upgrading my real
machine. My immediate next step is to, before even dealing with SSL, to
prevent plain text access, regardless of localhost or non-localhost,
haproxy or non-haproxy, whatever. Once that's done, I'll begin enabling
SSL. For security's sake, I need to *prove* that plain text access
fails in all cases.

So, how do I prevent plain text access, full stop?

Thanks,

SteveT

Steve Litt 

http://444domains.com
_______________________________________________
dovecot mailing list -- [email protected]
To unsubscribe send an email to [email protected]