IMAP002

IMAP Secure Login

Checks that insecure IMAP logins are not permitted.

Best Practice

IMAP logins should be configured to SecureLogin to prevent user credentials from being passed over the network in the clear.

What To Do

If SecureLogin is not enabled, you should enable it.

If SecureLogin is not enabled and you are not able to enable it for some reason, it is recommended to remove the insecure port binding for IMAP4, therefore requiring all connections to be made on the IMAP SSL port.

NOTE: This change may have an impact on any clients that are using insecure IMAP logins, requiring them to be reconfigured for secure login only.

Exceptions

n/a