OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: SASL vs. M$ Outlook and Outlook Express

From: Magnus Bäck (magnusdsek.lth.se)
Date: Mon Jan 01 2007 - 11:59:39 CST

On Monday, January 01, 2007 at 14:32 CET,
     Rene van Hoek <reneactive8.nl> wrote:

> I did an telnet to your machine and that seems ok:
>
> Leto:/Volumes renevanhoek$ telnet mail.kovarovi.org 25
> Trying 194.212.102.169...
> Connected to bimbo.kovarovi.org.
> Escape character is '^]'.
> 220 mail.kovarovi.org ESMTP Postfix
> EHLO test.a8.nl
> 250-mail.kovarovi.org
> 250-PIPELINING
> 250-SIZE 10240000
> 250-VRFY
> 250-ETRN
> 250-AUTH PLAIN
> 250-AUTH=PLAIN
> 250-ENHANCEDSTATUSCODES
> 250-8BITMIME
> 250 DSN

No, that's not okay. The Microsoft-style LOGIN mechanism is missing.
More recent Microsoft clients may support the PLAIN mechansim as well,
but since people may be running older software I'd say it's a
requirement to provide both PLAIN and LOGIN.

While the OP is fixing LOGIN, I suggest he fixes support for CRAM-MD5
and DIGEST-MD5 as well so that clients won't be forced to send passwords
in the clear.

[...]

--
Magnus Bäck
magnusdsek.lth.se