moving $_SERVER to sqgetGlobalVar

[squirrelmail.git] / doc / authentication.txt

diff --git a/doc/authentication.txt b/doc/authentication.txt
index 73d1ed69477da359381aad1b8ca63c8817b29594..40dbee220b47e160861a923a6ec191b6f8134309 100644 (file)
--- a/doc/authentication.txt
+++ b/doc/authentication.txt
@@ -1,7 +1,7 @@
 **********************************************
 IMAP AND SMTP AUTHENTICATION WITH SQUIRRELMAIL
 **********************************************
 IMAP AND SMTP AUTHENTICATION WITH SQUIRRELMAIL

-Preliminary documentation - 20 Nov 2002
-Chris Hilts chilts@birdbrained.org
+$Id$
+Chris Hilts tassium@squirrelmail.org

 **********************************************
 
 Prior to SquirrelMail 1.3.3, only plaintext logins for IMAP and SMTP were
 **********************************************
 
 Prior to SquirrelMail 1.3.3, only plaintext logins for IMAP and SMTP were


@@ -12,17 +12,23 @@ SMTP. TLS is able to be enabled on a per-service basis as well.
 Unless the administrator changes the authentication methods, SquirrelMail
 will default to the "classic" plaintext methods, without TLS.
 
 Unless the administrator changes the authentication methods, SquirrelMail
 will default to the "classic" plaintext methods, without TLS.
 

+Note: There is no point in using TLS if your IMAP server is localhost. You need
+root to sniff the loopback interface, and if you don't trust root, or an attacker
+already has root, the game is over.  You've got a lot more to worry about beyond
+having the loopback interface sniffed.
+

 REQUIREMENTS
 ------------
 
 CRAM/DIGEST-MD5
 * SquirrelMail 1.3.3 or higher
 REQUIREMENTS
 ------------
 
 CRAM/DIGEST-MD5
 * SquirrelMail 1.3.3 or higher

-* The mhash extension for PHP. (Debian users: You're lucky.  Type 'apt-get
-  install php4-mhash' and you're done.)
+* If you have the mhash extension to PHP, it will automatically
+  be used, which may help performance on heavily loaded servers.
+  ** NOTE: mhash is optional and no longer a requirement **

 
 TLS
 * SquirrelMail 1.3.3 or higher
 
 TLS
 * SquirrelMail 1.3.3 or higher

-* PHP 4.3.0 or higher
+* PHP 4.3.0 or higher (Check Release Notes for PHP 4.3.x information)

 * The "STARTTLS" command is NOT supported.  The server you wish to use TLS
   on must have a dedicated port listening for TLS connections. (ie. port
   993 for IMAP, 465 for SMTP) 
 * The "STARTTLS" command is NOT supported.  The server you wish to use TLS
   on must have a dedicated port listening for TLS connections. (ie. port
   993 for IMAP, 465 for SMTP) 


@@ -32,6 +38,14 @@ CONFIGURATION
 
 All configuration is done using conf.pl, under main menu option #2.
 
 
 All configuration is done using conf.pl, under main menu option #2.
 

+conf.pl can now attempt to detect which mechanisms your servers support.
+You must have set the host and port before attempting to detect, or you
+may get inaccurate results, or a long wait while the connection times out.
+
+If you get results that you know are wrong when you use auto-detection, I
+need to know about it. Please send me the results you got, the results you
+expected, and server type, name, and version (eg. "imap, Cyrus, v2.1.9").
+

 KNOWN ISSUES
 ------------
 
 KNOWN ISSUES
 ------------
 


@@ -67,4 +81,26 @@ To get the challenge with SMTP:
        QUIT
        [server says bye, closes connection]
 
        QUIT
        [server says bye, closes connection]
 

+
+OPTIONAL SMTP AUTH CONFIGURATION
+--------------------------------
+
+If you need all users to send mail via an upstream SMTP provider
+(your ISP, for example), and that ISP requires authentication,
+there are two variables that can be added to config_local.php
+that will specify a sitewide SMTP username and password.
+
+Set up SMTP authentication to the remote server according to the 
+instructions above, then add the following to config_local.php, 
+replacing <smtp_user> and <smtp_pass> with the username and password
+you'd like to use for the entire site:
+
+  $smtp_sitewide_user = '<smtp_user>';
+  $smtp_sitewide_pass = '<smtp_pass>';
+
+These values will be used to connect to the SMTP server as long
+as the authentication mechanism is something besides 'none', i.e.
+'login','plain','cram-md5', or 'digest-md5'.
+
+

 [End]
 [End]