Should we block all plaintext authentication and require authentication over an encrypted channel?

Question

Should we configure our servers to require the authentication happen over an encrypted channel and block all methods of unencrypted, plaintext authentication over?

I recently configured my servers to disable all forms of plaintext authentication and require users to authenticate over a SSL-encrypted channel. For example:

• I disabled POP3 plaintext authentication - now users can authenticate only only over SSL (IMAPS)
• I disabled SMTP plaintext authentication - now users must authenticate via SMTPS (ESMPTSA)
• I disabled Exchange RPC - now users must authenticate via SSL (HTTPS)
• I disabled HTTP plaintext authentication - now users must authenticate via SSL (HTTPS), including for my website's backend, webmail and other web apps. Users who attempt to connect via HTTP receive a 301-redirect over to HTTPS.
• I disabled FTP plaintext authentication - now users must authenticate via SSL (FTPS only)
• I disabled API access from external websites (payment gateways etc)

I implemented this either through server changes (e.g., the mod_security module), by blocking access to certain ports (e.g., blocking the imap port and leaving the imaps port open), or by building my own reverse proxy to enforce these requirements.

Is this a good idea? Should everyone be disabling all forms of cleartext authentication (where credentials are sent unencrypted)? I noticed that some hosting companies still allow plaintext authentication; why do they do that? Should they disabling cleartext authentication, too?

Answer 1

The vulnerability is not in allowing plaintext authentication, but in using plaintext authentication. For instance, an open telnet service on a Unix system does not make the Unix system weak -- the people who actually use that service do make it weak.

Human nature being what it is, when a service it available, people will use it, so this is a good reason to close unprotected gates on a general basis. However, on my servers where all users are competent and trustworthy (because there is only one user, me, and I trust all my personalities), I occasionally find it worth to leave open some weak gates, because they could be useful in some situations where urgency bypasses the security safeguards: for instance, I could log in through an unprotected telnet because I trust myself for doing so only in somewhat safe situations (e.g. from a direct ethernet link) and to apply mitigation measures (such as changing my password immediately afterwards -- not a perfect measure, I know, but emergencies are emergencies).

^{(Your question tends to assume that the problem comes from WiFi, which is a dubious statement: believing cables to be safe, and, even more, the Internet to be free of eavesdropping beyond the WiFi access points, looks like an overoptimistic fantasy to me.)}