1
**********************************************
2
IMAP AND SMTP AUTHENTICATION WITH SQUIRRELMAIL
3
$Id: authentication.txt,v 1.6 2004/01/04 18:59:38 ebullient Exp $
4
Chris Hilts tassium@squirrelmail.org
5
**********************************************
7
Prior to SquirrelMail 1.3.3, only plaintext logins for IMAP and SMTP were
8
supported. With the release of SquirrelMail 1.3.3, support for the
9
CRAM-MD5 and DIGEST-MD5 auth mechanisms has been added. TLS support has
10
also been added. It is possible to use different methods for both IMAP and
11
SMTP. TLS is able to be enabled on a per-service basis as well.
12
Unless the administrator changes the authentication methods, SquirrelMail
13
will default to the "classic" plaintext methods, without TLS.
15
Note: There is no point in using TLS if your IMAP server is localhost. You need
16
root to sniff the loopback interface, and if you don't trust root, or an attacker
17
already has root, the game is over. You've got a lot more to worry about beyond
18
having the loopback interface sniffed.
24
* SquirrelMail 1.3.3 or higher
25
* If you have the mhash extension to PHP, it will automatically
26
be used, which may help performance on heavily loaded servers.
27
** NOTE: mhash is optional and no longer a requirement **
30
* SquirrelMail 1.3.3 or higher
31
* PHP 4.3.0 or higher (Check Release Notes for PHP 4.3.x information)
32
* The "STARTTLS" command is NOT supported. The server you wish to use TLS
33
on must have a dedicated port listening for TLS connections. (ie. port
34
993 for IMAP, 465 for SMTP)
39
All configuration is done using conf.pl, under main menu option #2.
41
conf.pl can now attempt to detect which mechanisms your servers support.
42
You must have set the host and port before attempting to detect, or you
43
may get inaccurate results, or a long wait while the connection times out.
45
If you get results that you know are wrong when you use auto-detection, I
46
need to know about it. Please send me the results you got, the results you
47
expected, and server type, name, and version (eg. "imap, Cyrus, v2.1.9").
52
DIGEST-MD5 has three different methods of operation. (qop options "auth",
53
"auth-int" and "auth-conf"). This implementation currently supports "auth"
54
only. Work is being done to add the other two modes.
56
DIGEST-MD5 _may_ fail when authenticating with servers that supply more
57
than one "realm". I have no servers of this type to test on, so if you do
58
and it fails, let me know! (A big help would be for you to telnet to your
59
server, start a DIGEST-MD5 auth session, and include the challenge from the
60
server in your bug report.)
62
To get the challenge with IMAP:
63
telnet <your server> imap
65
A01 AUTHENTICATE DIGEST-MD5
66
<copy the gobbledygook that the server sends - this is what I need>
68
[server says auth aborted]
70
[server says goodbye, closes connection]
72
To get the challenge with SMTP:
73
telnet <your server> smtp
74
[server sends some sort of "hello" banner]
76
[server will probably list a bunch of capabilities]
78
<copy the gobbledygook that the server sends - this is what I need>
80
[server says auth aborted]
82
[server says bye, closes connection]
85
OPTIONAL SMTP AUTH CONFIGURATION
86
--------------------------------
88
If you need all users to send mail via an upstream SMTP provider
89
(your ISP, for example), and that ISP requires authentication,
90
there are two variables that can be added to config_local.php
91
that will specify a sitewide SMTP username and password.
93
Set up SMTP authentication to the remote server according to the
94
instructions above, then add the following to config_local.php,
95
replacing <smtp_user> and <smtp_pass> with the username and password
96
you'd like to use for the entire site:
98
$smtp_sitewide_user = '<smtp_user>';
99
$smtp_sitewide_pass = '<smtp_pass>';
101
These values will be used to connect to the SMTP server as long
102
as the authentication mechanism is something besides 'none', i.e.
103
'login','plain','cram-md5', or 'digest-md5'.
added
removed
doc/authentication.txt
