3

Should we configure our servers to require the authentication happen over an encrypted channel and block all methods of unencrypted, plaintext authentication over?

I recently configured my servers to disable all forms of plaintext authentication and require users to authenticate over a SSL-encrypted channel. For example:

  • I disabled POP3 plaintext authentication - now users can authenticate only only over SSL (IMAPS)
  • I disabled SMTP plaintext authentication - now users must authenticate via SMTPS (ESMPTSA)
  • I disabled Exchange RPC - now users must authenticate via SSL (HTTPS)
  • I disabled HTTP plaintext authentication - now users must authenticate via SSL (HTTPS), including for my website's backend, webmail and other web apps. Users who attempt to connect via HTTP receive a 301-redirect over to HTTPS.
  • I disabled FTP plaintext authentication - now users must authenticate via SSL (FTPS only)
  • I disabled API access from external websites (payment gateways etc)

I implemented this either through server changes (e.g., the mod_security module), by blocking access to certain ports (e.g., blocking the imap port and leaving the imaps port open), or by building my own reverse proxy to enforce these requirements.

Is this a good idea? Should everyone be disabling all forms of cleartext authentication (where credentials are sent unencrypted)? I noticed that some hosting companies still allow plaintext authentication; why do they do that? Should they disabling cleartext authentication, too?

2
  • I'm having a difficult time decoding what you are asking. When you say "removed", what exactly did you do? (did you add a firewall rule? disable it in the server? configure your client to connect via SSL? something else?) Also, I think the question might be a bit on the chatty side (this is not a discussion forum, and not the right place for a rant about how hosting companies are "so wrong"). It would help to re-focus your post on a specific technical problem or a focused question that is likely to have a specific answer. Do you think you could try revising your question accordingly?
    – D.W.
    Sep 2, 2012 at 0:18
  • I have removed plaintext authentication method on SMTP, HTTP ... IMAP, the way that to port 25 you cant send Login, but you need to issue STARTTLS command first, and then you can send login. On imap for example, I blocked port "imap", and left only "imaps". On Web server, I have redirected with code 301 to HTTPS website. FTP doesnt accept any plaintext logins too. Sep 2, 2012 at 12:26

1 Answer 1

6

The vulnerability is not in allowing plaintext authentication, but in using plaintext authentication. For instance, an open telnet service on a Unix system does not make the Unix system weak -- the people who actually use that service do make it weak.

Human nature being what it is, when a service it available, people will use it, so this is a good reason to close unprotected gates on a general basis. However, on my servers where all users are competent and trustworthy (because there is only one user, me, and I trust all my personalities), I occasionally find it worth to leave open some weak gates, because they could be useful in some situations where urgency bypasses the security safeguards: for instance, I could log in through an unprotected telnet because I trust myself for doing so only in somewhat safe situations (e.g. from a direct ethernet link) and to apply mitigation measures (such as changing my password immediately afterwards -- not a perfect measure, I know, but emergencies are emergencies).

(Your question tends to assume that the problem comes from WiFi, which is a dubious statement: believing cables to be safe, and, even more, the Internet to be free of eavesdropping beyond the WiFi access points, looks like an overoptimistic fantasy to me.)

1
  • Wifi can be exploted by everyone coming to company, and setting up the wifi access point with a duplicated name. With cables, it's much harder. Sep 1, 2012 at 13:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .