On Thu, 9 Dec 2004 16:53:30 -0500 (EST), Charles Sprickman <[EMAIL PROTECTED]> wrote: > On Wed, 8 Dec 2004, Tom Collins wrote: > > > > > On Dec 8, 2004, at 8:04 AM, Pedro Pais wrote: > >> When a user tries to authenticate itself, the first time vchkpw fails with: > >> > >> "Dec 6 21:50:08 [vpopmail] vchkpw-smtp: password fail" > >> > >> but then it succeeds immediatly after: > >> > >> "Dec 6 21:50:13 [vpopmail] vchkpw-smtp: (PLAIN) login success" > >> > >> This is very annoying, besides the fact that this only happens with > >> Thunderbird, with other e-mail clients they give an error message and > >> the connection is terminated. Is there any way to solve this thing? > > > > It looks like the client is trying CRAM-MD5, failing, and then using PLAIN > > authentication. > > > > You probably have an older patch, or a version problem between the smtp-auth > > patch and vpopmail. The older patch sent the information in the incorrect > > order, and vpopmail was written to accept it in that order. We fixed > > vpopmail for the 5.4.0 release, but it required updating to the correct SMTP > > AUTH patch. > > Also, I'm fairly certain that CRAM-MD5 requires that you have clear-text > passwords enabled. I still need to look at my pop and smtp servers to see > how I can make them not advertise something that's not available on my > system... > > Charles Really? That doesn't sound too secure, or even ethical. Well, I've found a way to disable the announcement of CRAM-MD5: edit qmail-smtpd.c, and delete (or comment out) the line that says "#define AUTHCRAM". Then compile, install qmal and CRAM-MD5 support is gone.
> > > > > If you're using vpopmail 5.4.0 and later, make sure you're using an > > up-to-date patch that passes the MD5 challenge and response in the correct > > order. The patch in vpopmail's contrib directory works properly. > > > > -- > > Tom Collins - [EMAIL PROTECTED] > > QmailAdmin: http://qmailadmin.sf.net/ Vpopmail: http://vpopmail.sf.net/ > > Info on the Sniffter hand-held Network Tester: http://sniffter.com/ > > > > > -- Pedro Pais Skype name: pedro.pais MSN: [EMAIL PROTECTED] Get Firefox! http://www.spreadfirefox.com/community/?q=affiliates&id=3759&t=1
