install_update_dovecot: do not log attempted passwords

Set auth_verbose_passwords to 'no'. 'plain' and 'yes' write attempted
passwords in cleartext to the log, including the real passwords of users
who only made a typo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

install_update_dovecot-2.4.sh

@@ -6874,7 +6874,7 @@ if [[ $dovecot_major_version -gt 2 ]] \
    #     log_path =syslog
    #     syslog_facility = local1
    #     auth_verbose = yes
-   #     auth_verbose_passwords = plain
+   #     auth_verbose_passwords = no
    #
    #
    # in conjunction with the the following entries in /etc/rsyslog.conf
@@ -6949,7 +6949,9 @@ EOF
 
    if grep -qE "^\s*auth_verbose_passwords\s*=" "${_conf_file}"; then
 
-      replace_variable "auth_verbose_passwords" "yes" "${_conf_file}" || _failed=true
+      # - Never log attempted passwords: 'yes' and 'plain' write them in cleartext to
+      # - the log, including the real passwords of users who only made a typo.
+      replace_variable "auth_verbose_passwords" "no" "${_conf_file}" || _failed=true
 
    else
 
@@ -6962,7 +6964,10 @@ EOF
 #
 #    plain, yes: Output cleartext password (NOT RECOMMENDED)
 #    sha1: Output SHA1 hashed password
-auth_verbose_passwords = plain
+#
+# Never log attempted passwords: they also contain real passwords of users
+# who only made a typo.
+auth_verbose_passwords = no
 EOF
    fi
 
@@ -7000,7 +7005,7 @@ else
    ## -    log_path = syslog
    ## -    syslog_facility = local1
    ## -    auth_verbose = yes
-   ## -    auth_verbose_passwords = plain
+   ## -    auth_verbose_passwords = no
    ## -
    ## - in conjunction with the the following entries in /etc/rsyslog.conf
    ## -
@@ -7018,7 +7023,7 @@ else
       ${_conf_file} || _failed=true
    perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose\ ?=.*)#\1\#\# \2\n\1auth_verbose = yes#g" \
       ${_conf_file} || _failed=true
-   perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose_passwords\ ?=.*)#\1\#\# \2\n\1auth_verbose_passwords = plain#g" \
+   perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose_passwords\ ?=.*)#\1\#\# \2\n\1auth_verbose_passwords = no#g" \
       ${_conf_file} || _failed=true
 
    if ! $_failed ; then