POP3 Cleartext Logins Permitted

Synopsis

The remote POP3 daemon allows credentials to be transmitted in cleartext.

Description

The remote host is running a POP3 daemon that allows cleartext logins over unencrypted connections. An attacker can uncover user names and passwords by sniffing traffic to the POP3 daemon if a less secure authentication mechanism (eg, USER command, AUTH PLAIN, AUTH LOGIN) is used.

Solution

Contact your vendor for a fix or encrypt traffic with SSL / TLS using stunnel.
In this case we have several options:
  1. disable "auth plain" and "auth login" in dovecot config and allow md5 or other encrypted logins
  2. enable/configure stunnel to receive the traffic and encrypt it with an SSL
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

 SSL Ciphers list for dovecot

The following ciphers needs to be added/configured in /etc/dovecot/conf.d/10-ssl.conf...