Hi all,

Ok, up until now, I've only always allowed IMAPS connections to dovecot on port 993.

I want to also start allowing clients to user port143+STARTTLS, but I walso want to make sure both ports are locked down to ONLY allow secure connections.

So... is disable_plaintext_auth = yes in the main config enough to accomplish this?

http://wiki2.dovecot.org/SSL/DovecotConfiguration says:

There are a couple of different ways to specify when SSL/TLS is required:

disable_plaintext_auth=yes allows plaintext authentication
<http://wiki2.dovecot.org/Authentication/Mechanisms> only when
SSL/TLS is used first.

*

ssl = required requires SSL/TLS also for non-plaintext
authentication <http://wiki2.dovecot.org/Authentication/Mechanisms>.

*

If you have only plaintext mechanisms enabled
(auth { mechanisms = plain login } ), you can use either (or both)
of the above settings. They behave exactly the same way then

and the comments in 10-auth.conf say:

Disable LOGIN command and all other plaintext authentications unless

SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP

matches the local IP (ie. you're connecting from the same computer), the

connection is considered secure and plaintext authentication is allowed.

See also ssl=required setting.

#disable_plaintext_auth = yes

These seem to be saying that all I need to do is set either or both (ssl-required and/or disable_plaintext_auth=yes).

I'm looking for the simplest, and don't like redundant/unnecessary settings, so... which is the best/preferred way?

And what is the difference between ssl=required and disable_plaintext_auth=yes?

Thanks,

--

Best regards,

*/Charles/***