Depending on the system configuration, users can access their mailboxes with mail clients that use the standard IMAP4 protocols.
Depending on the configuration of clients and server, Messaging and the email client can send passwords in encrypted or unencrypted (cleartext) form. Use SSL or Simple Authentication and Security Layer (SASL) to ensure Messaging and clients transport passwords in encrypted form.
SSL versions of the IMAP4, and SMTP protocols are supported by most email clients. For example, users enable SSL encryption while setting up their Messaging account in Outlook or Zimbra. In these configurations, the entire IMAP4 or SMTP conversation is encrypted. Although the Challenge-Response Authentication Mechanism-Message Digest 5 (CRAM-MD5) authentication mechanism can be used (which by itself is not considered strong), transport layer security used by SSL ensures the user password is protected.
For clients connected to Messaging with the Avaya Storage Server, the Storage Server requires SMTP user authentication. The user authentication verifies that the sender of a message is in the domain. This feature ensures that spammers cannot send messages from the system.
Because anyone can observe packets in transit, it’s important to use encryption to prevent unauthorized access to subscriber accounts. Customers who want to keep message content private should use only SSL-capable clients. If SSL encryption cannot be used, customers should at a minimum require clients that support CRAM-MD5 authentication.
Messaging supports the SSL protocol for IMAP4 and SMTP. The SSL protocol provides communications privacy over the Internet. The protocol allows applications to communicate in a way that prevents eavesdropping, tampering, or message forgery. Administrators can enable IMAP4 SSL access on the message server. Subscribers can also configure their e-mail clients to use Transport Layer Security (TLS). Subscribers can configure clients for SSL operation over the administered IMAP4 SSL port. The same applies to SMTP.