From 15aca2f34b73fcfb28216a6494d5b033bb2342b1 Mon Sep 17 00:00:00 2001
From: Christoph <ckubu@oopen.de>
Date: Sun, 8 Nov 2026 14:55:13 +0100
Subject: [PATCH] install_update_dovecot: do not log attempted passwords

Set auth_verbose_passwords to 'no'. 'plain' and 'yes' write attempted
passwords in cleartext to the log, including the real passwords of users
who only made a typo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 install_update_dovecot-2.3.sh |  4 ++--
 install_update_dovecot-2.4.sh | 15 ++++++++++-----
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/install_update_dovecot-2.3.sh b/install_update_dovecot-2.3.sh
index d674ca4..8b023b1 100755
--- a/install_update_dovecot-2.3.sh
+++ b/install_update_dovecot-2.3.sh
@@ -2200,7 +2200,7 @@ fi
 ## -    log_path = syslog
 ## -    syslog_facility = local1
 ## -    auth_verbose = yes
-## -    auth_verbose_passwords = plain
+## -    auth_verbose_passwords = no
 ## -
 ## - in conjunction with the the following entries in /etc/rsyslog.conf
 ## -
@@ -2219,7 +2219,7 @@ perl -i -n -p -e "s#^([ ]*)\#?\ ?(syslog_facility\ ?=.*)#\1\#\# \2\n\1syslog_fac
    /usr/local/dovecot-${_version}/etc/dovecot/conf.d/10-logging.conf || _failed=true
 perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose\ ?=.*)#\1\#\# \2\n\1auth_verbose = yes#g" \
    /usr/local/dovecot-${_version}/etc/dovecot/conf.d/10-logging.conf || _failed=true
-perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose_passwords\ ?=.*)#\1\#\# \2\n\1auth_verbose_passwords = plain#g" \
+perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose_passwords\ ?=.*)#\1\#\# \2\n\1auth_verbose_passwords = no#g" \
    /usr/local/dovecot-${_version}/etc/dovecot/conf.d/10-logging.conf || _failed=true
 
 if ! $_failed ; then
diff --git a/install_update_dovecot-2.4.sh b/install_update_dovecot-2.4.sh
index 7e9ded6..dd6c445 100755
--- a/install_update_dovecot-2.4.sh
+++ b/install_update_dovecot-2.4.sh
@@ -6874,7 +6874,7 @@ if [[ $dovecot_major_version -gt 2 ]] \
    #     log_path =syslog
    #     syslog_facility = local1
    #     auth_verbose = yes
-   #     auth_verbose_passwords = plain
+   #     auth_verbose_passwords = no
    #
    #
    # in conjunction with the the following entries in /etc/rsyslog.conf
@@ -6949,7 +6949,9 @@ EOF
 
    if grep -qE "^\s*auth_verbose_passwords\s*=" "${_conf_file}"; then
 
-      replace_variable "auth_verbose_passwords" "yes" "${_conf_file}" || _failed=true
+      # - Never log attempted passwords: 'yes' and 'plain' write them in cleartext to
+      # - the log, including the real passwords of users who only made a typo.
+      replace_variable "auth_verbose_passwords" "no" "${_conf_file}" || _failed=true
 
    else
 
@@ -6962,7 +6964,10 @@ EOF
 #
 #    plain, yes: Output cleartext password (NOT RECOMMENDED)
 #    sha1: Output SHA1 hashed password
-auth_verbose_passwords = plain
+#
+# Never log attempted passwords: they also contain real passwords of users
+# who only made a typo.
+auth_verbose_passwords = no
 EOF
    fi
 
@@ -7000,7 +7005,7 @@ else
    ## -    log_path = syslog
    ## -    syslog_facility = local1
    ## -    auth_verbose = yes
-   ## -    auth_verbose_passwords = plain
+   ## -    auth_verbose_passwords = no
    ## -
    ## - in conjunction with the the following entries in /etc/rsyslog.conf
    ## -
@@ -7018,7 +7023,7 @@ else
       ${_conf_file} || _failed=true
    perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose\ ?=.*)#\1\#\# \2\n\1auth_verbose = yes#g" \
       ${_conf_file} || _failed=true
-   perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose_passwords\ ?=.*)#\1\#\# \2\n\1auth_verbose_passwords = plain#g" \
+   perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose_passwords\ ?=.*)#\1\#\# \2\n\1auth_verbose_passwords = no#g" \
       ${_conf_file} || _failed=true
 
    if ! $_failed ; then