Should we configure our servers to require the authentication happen over an encrypted channel and block all methods of unencrypted, plaintext authentication over?
I recently configured my servers to disable all forms of plaintext authentication and require users to authenticate over a SSL-encrypted channel. For example:
- I disabled POP3 plaintext authentication - now users can authenticate only only over SSL (IMAPS)
- I disabled SMTP plaintext authentication - now users must authenticate via SMTPS (ESMPTSA)
- I disabled Exchange RPC - now users must authenticate via SSL (HTTPS)
- I disabled HTTP plaintext authentication - now users must authenticate via SSL (HTTPS), including for my website's backend, webmail and other web apps. Users who attempt to connect via HTTP receive a 301-redirect over to HTTPS.
- I disabled FTP plaintext authentication - now users must authenticate via SSL (FTPS only)
- I disabled API access from external websites (payment gateways etc)
I implemented this either through server changes (e.g., the mod_security module), by blocking access to certain ports (e.g., blocking the imap port and leaving the imaps port open), or by building my own reverse proxy to enforce these requirements.
Is this a good idea? Should everyone be disabling all forms of cleartext authentication (where credentials are sent unencrypted)? I noticed that some hosting companies still allow plaintext authentication; why do they do that? Should they disabling cleartext authentication, too?