Subject: [imapext] LOGINDISABLED

From: Cyrus Daboo <[email-masked]>
Date: Fri, 07 Jun 2013 11:59:53 -0500

Hi,
RFC3501 defines a LOGINDISABLED property that is used prior to STARTTLS (or 
some out of band security) being in place to ensure the LOGIN command is 
not used in an insecure environment. Some servers also offer configuration 
to also disable plain text authentication even when a security layer is in 
place. In that situation, should (must) the server advertise LOGINDISABLED 
in capabilities sent after STARTTLS? The spec really does not cover that 
case explicitly.

Personally I think anytime the server is going to reject LOGIN it ought to 
advertise LOGINDISABLED to ensure clients don't "blindly" send the clear 
text credentials - because the purpose of disabling LOGIN is to stop that 
happening in the first place.

-- 
Cyrus Daboo

---

From: Timo Sirainen <[email-masked]>
Date: Fri, 7 Jun 2013 20:13:13 +0300

On 7.6.2013, at 19.59, Cyrus Daboo <[email-masked]> wrote:

> Hi,
> RFC3501 defines a LOGINDISABLED property that is used prior to STARTTLS (or some out of band security) being in place to ensure the LOGIN command is not used in an insecure environment. Some servers also offer configuration to also disable plain text authentication even when a security layer is in place. In that situation, should (must) the server advertise LOGINDISABLED in capabilities sent after STARTTLS? The spec really does not cover that case explicitly.
> 
> Personally I think anytime the server is going to reject LOGIN it ought to advertise LOGINDISABLED to ensure clients don't "blindly" send the clear text credentials - because the purpose of disabling LOGIN is to stop that happening in the first place.

Yeah, good idea. Added to Dovecot v2.2.

---

From: Dave Cridland <[email-masked]>
Date: Fri, 7 Jun 2013 22:33:06 +0100

> Yeah, good idea. Added to Dovecot v2.2.
RFC 3501 §7.2.1, para 4:

      The LOGINDISABLED capability indicates that the LOGIN command is
      disabled, and that the server will respond with a tagged NO
      response to any attempt to use the LOGIN command even if the user
      name and password are valid.  An IMAP client MUST NOT issue the
      LOGIN command if the server advertises the LOGINDISABLED
      capability.

No mention of STARTTLS.

So yes, if the LOGIN command is disabled for any reason, then advertising
LOGINDISABLED seems to be the right thing to do according to the
specification.