<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body><div>On Wed, Jun 1, 2016, at 03:28 AM, qyb via Cyrus-devel wrote:<br></div>
<blockquote type="cite"><div dir="ltr"><div>I noticed that cyrus disable TLS on preauth'd connection.<br></div>
<div><div> </div>
<div>Authentication info(plain password...) need TLS protection. And I think that RFC822 text also need TLS.<br></div>
</div>
</div>
</blockquote><div> </div>
<div>Can you expand on this a bit?<br></div>
<div> </div>
<div>As far as I understand, connections are only ever preauth'd when they come in via UNIX-domain sockets, which are inherently local. What are you trying to protect, and from whom?<br></div>
<div> </div>
<div>For what it's worth, it looks like STARTTLS used to work (at least to some degree) for preauth'd LMTP, but was explicitly disabled in 2001 by this commit:<br></div>
<div><a href="https://cgit.cyrus.foundation/cyrus-imapd/commit/?id=b93e6be5b19362f9e295b40ceb81b702d73de6bb">https://cgit.cyrus.foundation/cyrus-imapd/commit/?id=b93e6be5b19362f9e295b40ceb81b702d73de6bb</a><br></div>
<div>So I guess you might be able to re-enable it by doing the inverse of that, though I'm not really seeing the point?<br></div>
</body>
</html>