diff --git a/install/tpl/debian_dovecot.conf.master b/install/tpl/debian_dovecot.conf.master
index 070e6dde3cc96096c404856647d5cd64b48d1a69..31c114715669c8dd6e5b800190773f31c42ffe4f 100644
--- a/install/tpl/debian_dovecot.conf.master
+++ b/install/tpl/debian_dovecot.conf.master
@@ -51,7 +51,7 @@ listen = *,[::]
 # SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
 # matches the local IP (ie. you're connecting from the same computer), the
 # connection is considered secure and plaintext authentication is allowed.
-disable_plaintext_auth = no
+disable_plaintext_auth = yes
 
 # Should all IMAP and POP3 processes be killed when Dovecot master process
 # shuts down. Setting this to "no" means that Dovecot can be upgraded without
@@ -818,7 +818,7 @@ auth default {
   # Space separated list of wanted authentication mechanisms:
   #   plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi
   # NOTE: See also disable_plaintext_auth setting.
-  mechanisms = plain login
+  mechanisms = plain login digest-md5 cram-md5
 
   #
   # Password database is used to verify user's password (and nothing more).