Hello,
talking to oneself seems to be all the rage on this ML, so I shall join that trend.
As it turns out this was a case of slightly muddled/unclear error messages, the client sees:
-ERR Plaintext authentication disallowed on non-secure (SSL/TLS) connections.
But the actual issue was that the newly added "login_source_ips" (the main reason for this upgrade, as we're running out of ports) was not not in the "trusted_networks" of the target mailbox server.
So the failure was between proxy and mailbox server, not client and proxy.
After adding that network all is working now as expected.
Christian
On Tue, 2 Aug 2016 16:02:34 +0900 Christian Balzer wrote:
Hello,
this is basically a repeat of this query from last year, which unfortunately got a deafening silence for replies:
http://dovecot.org/pipermail/dovecot/2015-August/101720.html
I have mostly 2.1.7 (Debian Wheezy) mailbox servers and the current proxies are also of that vintage.
So with "ssl=yes" and "disable_plaintext_auth=no" plaintext logins work, as per the documentation (http://wiki2.dovecot.org/SSL/DovecotConfiguration) and historically expected.
Trying to use a 2.2.24 (Debian Jessie backports) dovecot proy with the same parameters fails like this:
Aug 2 15:45:57 smtp12 dovecot: pop3-login: proxy(chibixxx@gol.com): Login failed to mbxx.xxx.gol.com:110: Plaintext authentication disallowed on non-secure (SSL/TLS) connections.: user=chibixxx@gol.com, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, pid=16066
Changing things to "ssl=no" doesn't help and setting trusted networks only changes the last bit to have "secured" appended but still fails the same otherwise.
I really need 2.2.x to behave the same way as before and documented.
Any ideas and feedback would be most welcome.
Regards,
Christian
--
Christian Balzer Network/Systems Engineer
chibi@gol.com Global OnLine Japan/Rakuten Communications
http://www.gol.com/