Re: [SPAM] Re: [vchkpw] [SPAM] Re: [vchkpw] [SPAM] Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp

PLAIN authentication is ok, provided that TLS has been activated by the 
client (presumably before credentials are sent) or SSL is in use 
(unconventional 465 port).

In changing this, each client will need to be manually reconfigured. I'm 
not aware of any client that automatically adjusts to changes such as this.

I'm not aware of a practical way to require encrypted passwords for 
qmail-smtpd (whether on port 25 or 587) at this point. Spamdyke has a 
recent feature allowing it to handle authentication, and I believe that 
Sam will be adding a setting to require encryption before authentication 
in the next release. When that's available, I'll be changing QMT to use 
spamdyke for authentication, which will (at last) allow for enforcement 
of this policy (no passwords sent in clear text).

On the retrieval side of things, dovecot provides such a configuration 
parameter, #disable_plaintext_auth = yes, which is the default value.

P.S. FWIW, I would have not expected to see (as many) unauthorized 
attempts on port 587. Spammers will eventually use this port though.

-- 
-Eric 'shubes'

On 03/05/2014 08:34 AM, LHTek wrote:
> I am using PLAIN text passwords I'm afraid. I will be changing that now
> though. I very tired of these password hacks.
>
> Since this will be a new process for me I have questions: In changing
> the server to require encrypted passwords, will I need to contact all my
> clients and have them change the way they connect? Or will their email
> clients just automate the change?
>
>
>
>
>     ------------------------------------------------------------------------
>     *From:* "[email protected]" <[email protected]>
>     *To:* [email protected]
>     *Sent:* Wednesday, March 5, 2014 6:45 AM
>     *Subject:* [vchkpw] [SPAM] Re: [vchkpw] [SPAM] Re: [vchkpw] [SPAM]
>     Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp
>
>     It doesn't matter how good your password is if you're using
>     plaintext connections :)
>     Since every MUA I've used i nthe last few years supports SSL or TLS
>     I should really get around to deprecating pop3 and imap and only
>     using pop3s and imaps.
>     This is especially imporant since some govts are trying to push
>     through laws forcing ISP's to store all of the data each of their
>     users downloads meaning that your unencrypted data will remain
>     stored for however long is legislated with access by who knows how
>     many people.
>     \\Clay
>     On 2014-03-05 07:57, Tom Collins wrote:
>>     The submission entries outside the US could very well be from
>>     hacked accounts.
>>     I'm finding a surprising number of compromised accounts (once a
>>     week?), including users with good passwords, so I have to assume
>>     they're snooped on public wireless, or their computers are
>>     compromised by malware of some sort.
>>     The vckpw-smtp entries from outside the US are probably also
>>     hacked accounts, since mail received from remote servers doesn't
>>     include authentication.  Sorry I wasn't thinking clearly in my
>>     previous response -- I forgot these were vchkpw entries and are
>>     only related to authentication.  I was thinking about qmail logs.
>>
>>     -Tom
>>
>>     On Mar 4, 2014, at 10:43 PM, LHTek wrote:
>>
>>>     Thanks for the reply.
>>>
>>>     NOTE: None of my users will have sent anything from outside the US.
>>>
>>>     I've got some log entries for vchkpw-submission (marked as
>>>     successful in the log) with non-US IP's (Russia, Egypt, Honk
>>>     Kong, etc).In my analysis I'm marking those entries as hacked
>>>     accounts.
>>>
>>>     From what I read from your response, vchkpw-smtp (marked as
>>>     successful in the log) entries could be mail sent TO my server
>>>     FROM another server on port 25. That tells me those are probably
>>>     safe submissions - even if they are from overseas IPs. Am I
>>>     thinking correctly?
>>>
>>>         ------------------------------------------------------------------------
>>>         *From:* Tom Collins <[email protected] <mailto:[email protected]>>
>>>         *To:* [email protected] <mailto:[email protected]>
>>>         *Sent:* Wednesday, March 5, 2014 12:02 AM
>>>         *Subject:* Re: [vchkpw] Qmail maillog vchkpw-submission vs
>>>         vchkpw-smtp
>>>
>>>         vchkpw-submission is on port 587, and is typically used for
>>>         emai clients relaying mail.  It's often set up to require
>>>         authentication.
>>>         vchkpw-smtp is on port 25, and can be used for email clients
>>>         to relay mail, or by other servers delivering mail to your
>>>         server.
>>>
>>>         -Tom
>>>
>>>         On Mar 4, 2014, at 9:41 PM, LHTek wrote:
>>>
>>>>         In the /var/log/maillog file what is the difference between
>>>>         these 2 entries (vchkpw-submission, vchkpw-smtp)?
>>>>         example:
>>>>         Mar  4 17:27:03 michael vpopmail[14701]: vchkpw-submission:
>>>>         (PLAIN) login success [email protected]:64.185.3.238
>>>>         Mar  4 10:54:42 michael vpopmail[29027]: vchkpw-smtp:
>>>>         (PLAIN) login success [email protected]:64.57.239.114
>>>
>>>
>
>
> 




!DSPAM:531756ed34261630194476!