Re: Preventing Plain Auth

Vladislav Kurz via dovecot said on Mon, 9 Mar 2026 10:29:41 +0100

>Dne 06. 03. 26 v 18:05 Steve Litt via dovecot napsal(a):

>> If you haven't yet transitioned from 2.3.x to 2.4.x, I'd suggest that
>> you get it running on a test machine before cutting over, because
>> there are some surprises.  
>
>I know it is off topic, but can you be more specific, what should I 
>watch for? I have several dovecot servers waiting for upgrade...

The most specific I can get is watch out for EVERYTHING having to do
with configuration. It's completely different, with different defaults,
in some cases different meanings for the same config options, in other
cases different names for the same config options, with meanings and
possible values perhaps the same and perhaps changed.

Not only is it completely different, but it's superficially similar
enough to fool you. Meanwhile, after all these months it's still
difficult to locate 2.4.x specific Dovecot docs, so web searches, AI
queries and even questions to live humans often get answered with 2.3.x
answers.

Aki answered your "what should I watch for" question by mentioning you
should review
https://doc.dovecot.org/latest/installation/upgrade/2.3-to-2.4.html .
This is the best answer to your question, but in my opinion that
question should come later. The first question should be "by what
process do I convert my configuration file(s)? And the answer to that
question depends on your situation, your abilities and disabilities.

Some people don't have Attention Deficit Disorder (ADD) and impatience.
For such people,
https://doc.dovecot.org/latest/installation/upgrade/2.3-to-2.4.html
doesn't look like "a wall of words" with heavy recursion to other
pages. For such people, reading and understanding this document enables
them to intelligently translate their 2.3 config to 2.4. Some people
are highly skilled professional admins (not developers, admins, there's
a big difference). Such people seem to just "know how" to do config.
They use Aki's suggested page as a reference. Speaking of developers,
some people are developers working on 2.4.x. Such people know this stuff
because heck, they wrote it. They sometimes refer back to Aki's
suggested page. Some people are geniuses with stratospheric IQs. They
somehow just "figure it out" by means I can't even contemplate. All
these people have an easier time translating 2.3 to 2.4, but every one
of them should do it first on a test setup, because only a crazy person
deploys something new on the live system before running it in a test
environment.

Then there are people like me, and there are a lot of us. Average
intelligence, ADD, impatient, either lightly or moderately familiar
with Dovecot (after all, til now once you got it working you could
coast for years). People like me must rewrite the config files from
scratch, starting with a 127.0.0.1 no-SSL "Hello World", and building
up, step by step, to what we need, on our test environment. In such a
situation, Aki's suggested document becomes an educational tool, as does
the conversion program at https://dovecot.org/upgrader/ , as does
(very badly at this point) AI, as does this mailing list.

So, to reiterate, my answer to your question "what should I watch
for?", my answer is "everything concerning configuration, but the
bigger priority is matching your process to your abilities and
disabilities, assets and liabilities."

SteveT

Steve Litt 

http://444domains.com
_______________________________________________
dovecot mailing list -- [email protected]
To unsubscribe send an email to [email protected]