Bug 737416 - Upgrade to Fedora 15 enabled insecure login
Summary: Upgrade to Fedora 15 enabled insecure login
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: dovecot
Version: 16
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Michal Hlavinka
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-09-11 22:24 UTC by David Woodhouse
Modified: 2011-10-16 00:59 UTC (History)
1 user (show)

Fixed In Version: dovecot-2.0.15-1.fc16
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-10-13 23:52:13 UTC


Attachments (Terms of Use)

Description David Woodhouse 2011-09-11 22:24:31 UTC
After upgrading to Fedora 15 from Fedora 13, I find that the insecure non-SSL pop3 and imap protocols have been enabled — with PLAIN auth!

My old config had these insecure protocols disabled, and the default installation should have them disabled too.

Comment 1 Michal Hlavinka 2011-09-13 09:33:38 UTC
I'll change it in Fedora 16 and rawhide. I don't want to break F15 installations.

Comment 2 David Woodhouse 2011-09-13 10:24:58 UTC
I understand the reticence but I'm not sure there are many people who would consider that 'breakage'.

I would ask that you reconsider, and *do* disable the unencrypted logins for Fedora 15.

Or failing that, is there at least a way to disable plain-text auth mechanisms lile PLAIN when you're on an unencrypted connection, and only accept things like CRAM-MD5 that don't give the password away?

Logging in over an unencrypted protocol with a plain-text password is *such* a broken thing that I would want a big shouty warning (like the one that sudo sends in email when a non-sudoer tries) if it ever happens.

Comment 3 Michal Hlavinka 2011-09-13 15:48:48 UTC
I understand your concerns, but it could break existing setups. Fixing this in released distro is too difficult. Also using more "advanced" configuration can cause even bigger breakage, because dovecot.conf is split in several files. If we change 2 files foo.cfg and bar.cfg where user changed bar.cfg he gets only half of the changes, because config file is updated only if user did not change it. So we can break it easily and can't guarantee that user gets required changes. So I'm not going to change anything in Fedora 15, sorry.

Comment 4 Fedora Update System 2011-09-13 15:49:51 UTC
dovecot-2.0.14-2.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/dovecot-2.0.14-2.fc16

Comment 5 Fedora Update System 2011-09-13 22:24:27 UTC
Package dovecot-2.0.14-2.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing dovecot-2.0.14-2.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/dovecot-2.0.14-2.fc16
then log in and leave karma (feedback).

Comment 6 Fedora Update System 2011-09-19 10:09:15 UTC
dovecot-2.0.15-1.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/dovecot-2.0.15-1.fc15

Comment 7 Fedora Update System 2011-09-19 10:09:25 UTC
dovecot-2.0.15-1.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/dovecot-2.0.15-1.fc14

Comment 8 Fedora Update System 2011-09-19 10:09:33 UTC
dovecot-2.0.15-1.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/dovecot-2.0.15-1.fc16

Comment 9 Fedora Update System 2011-10-13 23:52:13 UTC
dovecot-2.0.15-1.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2011-10-13 23:54:15 UTC
dovecot-2.0.15-1.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2011-10-16 00:59:25 UTC
dovecot-2.0.15-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.