diplodocus.org Git - nmh/blob - docs/README.SASL

   1 # README.SASL - Readme about SASL support in nmh
   2 #
   3
   4 SASL is short for the Simple Authentication and Security Layer.  Is is
   5 a framework for adding authentication and encryption to network protocols.
   6 It is described in IETF RFC 2222.
   7
   8 This release of nmh supports SASL for POP and SMTP.  The SASL support
   9 is implemented using the Cyrus-SASL library.  This library can be found
  10 at ftp://ftp.andrew.cmu.edu/pub/cyrus-mail.  Obviously, SASL support only
  11 works if you use --enable-pop and the SMTP mail transport.
  12
  13 This release of NMH only supports "Version 2" of the Cyrus SASL library.
  14 It should work with any newer Cyrus SASL release, but it was tested with
  15 Cyrus SASL 2.1.22.  In particular, the CRAM-MD5 and GSSAPI (Kerberos 5)
  16 mechanisms were tested.  Older versions of Cyrus-SASL had a bug which
  17 could manifest when negotiating encrypting depending on the encryption
  18 type you used, so a newer version of Cyrus-SASL is recommended.
  19
  20 Currently, security layers ("encryption" in SASL-speak) are supported
  21 for both POP and SMTP.  This means that if your POP or SMTP server
  22 _and_ the selected SASL mechanism supports it, client-server
  23 communications will be encrypted.  In theory this should work with
  24 any SASL mechanism that supports security layers; it has only been
  25 tested with the GSSAPI mechanism.
  26
  27 If you are curious as to whether or not your communications are actually
  28 encrypted or not, you can use the -snoop flag to the POP or SMTP utilities.
  29 Communication that is encrypted is preceded by an (encrypted) or
  30 (decrypted), depending on the direction of communication.
  31
  32 If you would like to use the GSSAPI SASL mechanism (Kerberos V), you
  33 should read very carefully the documentation that comes with
  34 Cyrus-SASL, specifically the GSSAPI documentation.  Getting the GSSAPI
  35 plugin to work correctly with SASL can be "interesting" to say the least.