diff --git a/VERSION b/VERSION
index 6b4950e..005119b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.4
+2.4.1
diff --git a/configure b/configure
index dfa2ef0..5599dda 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for E-MailRelay 2.4.
+# Generated by GNU Autoconf 2.69 for E-MailRelay 2.4.1.
 #
 #
 # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
@@ -577,8 +577,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='E-MailRelay'
 PACKAGE_TARNAME='emailrelay'
-PACKAGE_VERSION='2.4'
-PACKAGE_STRING='E-MailRelay 2.4'
+PACKAGE_VERSION='2.4.1'
+PACKAGE_STRING='E-MailRelay 2.4.1'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
@@ -1378,7 +1378,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures E-MailRelay 2.4 to adapt to many kinds of systems.
+\`configure' configures E-MailRelay 2.4.1 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1445,7 +1445,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of E-MailRelay 2.4:";;
+     short | recursive ) echo "Configuration of E-MailRelay 2.4.1:";;
    esac
   cat <<\_ACEOF
 
@@ -1579,7 +1579,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-E-MailRelay configure 2.4
+E-MailRelay configure 2.4.1
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2015,7 +2015,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by E-MailRelay $as_me 2.4, which was
+It was created by E-MailRelay $as_me 2.4.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2880,7 +2880,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='emailrelay'
- VERSION='2.4'
+ VERSION='2.4.1'
 
 
 # Some tools Automake needs.
@@ -10868,7 +10868,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by E-MailRelay $as_me 2.4, which was
+This file was extended by E-MailRelay $as_me 2.4.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -10934,7 +10934,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-E-MailRelay config.status 2.4
+E-MailRelay config.status 2.4.1
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/configure.ac b/configure.ac
index 0cf337a..7f06df5 100755
--- a/configure.ac
+++ b/configure.ac
@@ -19,7 +19,7 @@ dnl
 dnl Process this file with autoconf to produce a configure script.
 dnl
 
-AC_INIT([E-MailRelay],[2.4],[],[emailrelay])
+AC_INIT([E-MailRelay],[2.4.1],[],[emailrelay])
 AC_CONFIG_SRCDIR([src/glib/gdef.h])
 AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([no-define])
diff --git a/debian/changelog b/debian/changelog
index 1369d70..2174cf4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -9,7 +9,7 @@ emailrelay (2.4) unstable; urgency=low
   * The Linux event loop uses "epoll" by default rather than "select".
   * Some support for message routing (see NEWS).
   * Fix of error handling in network client filters ("--client-filter=net:...") [bug-id #50].
- -- maintainer graeme_walker <graeme_walker@users.sourceforge.net>  Fri, 28 Oct 2022 00:00:00 +0000
+ -- maintainer graeme_walker <graeme_walker@users.sourceforge.net>  Sun, 27 Nov 2022 00:00:00 +0000
 
 emailrelay (2.3) unstable; urgency=low
   * Unix domain sockets supported (eg. "--interface=/tmp/smtp.s").
diff --git a/doc/conf.py.sphinx b/doc/conf.py.sphinx
index c8c852c..d3fe573 100644
--- a/doc/conf.py.sphinx
+++ b/doc/conf.py.sphinx
@@ -9,8 +9,8 @@ master_doc = 'index'
 project = u'E-MailRelay'
 copyright = u'2022, Graeme Walker'
 author = u'Graeme Walker'
-version = u'2.4'
-release = u'2.4'
+version = u'2.4.1'
+release = u'2.4.1'
 language = None
 today_fmt = '%Y-%m-%d'
 exclude_patterns = []
diff --git a/emailrelay.spec b/emailrelay.spec
index cbd0711..aba96d2 100644
--- a/emailrelay.spec
+++ b/emailrelay.spec
@@ -1,11 +1,11 @@
 Summary: Simple e-mail message transfer agent and proxy using SMTP
 Name: emailrelay
-Version: 2.4
+Version: 2.4.1
 Release: 1
 License: GPL3
 Group: System Environment/Daemons
 URL: http://emailrelay.sourceforge.net
-Source: http://sourceforge.net/projects/emailrelay/files/emailrelay/2.4/emailrelay-2.4-src.tar.gz
+Source: http://sourceforge.net/projects/emailrelay/files/emailrelay/2.4.1/emailrelay-2.4.1-src.tar.gz
 BuildRoot: /tmp/emailrelay-install
 ##BuildRequires: systemd-rpm-macros
 
diff --git a/src/gauth/gsecretsfile.cpp b/src/gauth/gsecretsfile.cpp
index 9648e25..caf7732 100644
--- a/src/gauth/gsecretsfile.cpp
+++ b/src/gauth/gsecretsfile.cpp
@@ -166,11 +166,14 @@ void GAuth::SecretsFile::processLine( Contents & contents ,
             addWarning( contents , line_number , "invalid base64 encoding in fourth field"_sv ) ;
 		if( !valid_id || !valid_secret )
 			return ;
-		type = "plain"_sv ;
-        id_or_ip = G::Xtext::encode( G::Base64::decode(id_or_ip) ) ;
-        secret = G::Xtext::encode( G::Base64::decode(secret) ) ;
+        std::string xtext_id_or_ip = G::Xtext::encode( G::Base64::decode(id_or_ip) ) ;
+        std::string xtext_secret = G::Xtext::encode( G::Base64::decode(secret) ) ;
+		processLineImp( contents , line_number , side , "plain"_sv , xtext_id_or_ip , xtext_secret ) ;
+	}
+	else
+	{
+		processLineImp( contents , line_number , side , type , id_or_ip , secret ) ;
 	}
-	processLineImp( contents , line_number , side , type , id_or_ip , secret ) ;
 }
 
 void GAuth::SecretsFile::processLineImp( Contents & contents ,
diff --git a/src/gui/emailrelay-gui.rc b/src/gui/emailrelay-gui.rc
index 9bb4ffa..5ef7337 100644
--- a/src/gui/emailrelay-gui.rc
+++ b/src/gui/emailrelay-gui.rc
@@ -7,8 +7,8 @@ LANGUAGE 0x9,0x1
 IDI_ICON1 ICON DISCARDABLE "emailrelay-icon.ico"
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 2, 4, 0, 0
- PRODUCTVERSION 2, 4, 0, 0
+ FILEVERSION 2, 4, 1, 0
+ PRODUCTVERSION 2, 4, 1, 0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -26,12 +26,12 @@ BEGIN
             VALUE "Comments", "GPL v3 license"
             VALUE "CompanyName", " "
             VALUE "FileDescription", "E-MailRelay GUI Application"
-            VALUE "FileVersion", "2, 4, 0, 0"
+            VALUE "FileVersion", "2, 4, 1, 0"
             VALUE "InternalName", "emailrelay"
             VALUE "LegalCopyright", "Copyright (C) 2001-2022 Graeme Walker <graeme_walker@users.sourceforge.net>"
             VALUE "OriginalFilename", "emailrelay-gui.exe"
             VALUE "ProductName", "E-MailRelay"
-            VALUE "ProductVersion", "2, 4, 0, 0"
+            VALUE "ProductVersion", "2, 4, 1, 0"
         END
     END
     BLOCK "VarFileInfo"
diff --git a/src/gui/installer.cpp b/src/gui/installer.cpp
index fb02d32..2189f0d 100644
--- a/src/gui/installer.cpp
+++ b/src/gui/installer.cpp
@@ -247,15 +247,21 @@ struct CreateSecrets : public ActionBase
 {
 	G::Path m_path ;
 	G::Path m_template ;
-	G::StringMap m_content ;
+	struct Item
+	{
+		std::string key ; // "client plain:b" or "server plain:b BOB==" or "server none"
+		std::string key2 ; // "client plain" or "server plain b+0B" or ""
+		std::string line ; // "client plain:b ALICE== PWD==" or "server plain:b BOB== PWD==" or "server none 127.0.0.1 trusted"
+	} ;
+	std::vector<Item> m_content ;
 	CreateSecrets( const std::string & config_dir , const std::string & filename , G::Path template_ , const G::MapFile & pvalues ) ;
 	void run() override ;
 	trstring text() const override ;
 	std::string subject() const override ;
 	static bool match( std::string , std::string ) ;
 	static bool yes( const std::string & ) ;
-	void addSecret( G::StringMap & , const G::MapFile & , const std::string & k ) const ;
-	void addSecret( G::StringMap & , const G::MapFile & , const std::string & side , const std::string & k1 , const std::string & k2 ) const ;
+	void addSecret( const G::MapFile & , const std::string & k ) ;
+	void addSecret( const G::MapFile & , const std::string & side , const std::string & k1 , const std::string & k2 ) ;
 	Q_DECLARE_TR_FUNCTIONS(CreateSecrets)
 } ;
 
@@ -703,18 +709,18 @@ CreateSecrets::CreateSecrets( const std::string & config_dir , const std::string
 {
 	if( yes(p.value("do-pop")) )
 	{
-		addSecret( m_content , p , "server" , "pop-auth-mechanism" , "pop-account-1" ) ;
-		addSecret( m_content , p , "server" , "pop-auth-mechanism" , "pop-account-2" ) ;
-		addSecret( m_content , p , "server" , "pop-auth-mechanism" , "pop-account-3" ) ;
+		addSecret( p , "server" , "pop-auth-mechanism" , "pop-account-1" ) ;
+		addSecret( p , "server" , "pop-auth-mechanism" , "pop-account-2" ) ;
+		addSecret( p , "server" , "pop-auth-mechanism" , "pop-account-3" ) ;
 	}
 	if( yes(p.value("do-smtp")) && yes(p.value("smtp-server-auth")) )
 	{
-		addSecret( m_content , p , "server" , "smtp-server-auth-mechanism" , "smtp-server-account" ) ;
-		addSecret( m_content , p , "smtp-server-trust" ) ;
+		addSecret( p , "server" , "smtp-server-auth-mechanism" , "smtp-server-account" ) ;
+		addSecret( p , "smtp-server-trust" ) ;
 	}
 	if( yes(p.value("do-smtp")) && yes(p.value("smtp-client-auth")) )
 	{
-		addSecret( m_content , p , "client" , "smtp-client-auth-mechanism" , "smtp-client-account" ) ;
+		addSecret( p , "client" , "smtp-client-auth-mechanism" , "smtp-client-account" ) ;
 	}
 }
 
@@ -723,32 +729,42 @@ bool CreateSecrets::yes( const std::string & s )
 	return G::Str::isPositive( s ) ;
 }
 
-void CreateSecrets::addSecret( G::StringMap & content , const G::MapFile & p , const std::string & k ) const
+void CreateSecrets::addSecret( const G::MapFile & p , const std::string & k )
 {
 	if( !p.value(k).empty() )
 	{
-		std::string head = "server none " + p.value(k) ;
-		std::string tail = "trusted" ;
-		content[head] = head + " " + tail ;
+		std::string address_range = p.value( k ) ;
+		m_content.push_back( {
+			"" ,
+			"" ,
+			"server none " + address_range + " trusted" } ) ;
 	}
 }
 
-void CreateSecrets::addSecret( G::StringMap & content , const G::MapFile & p ,
-	const std::string & side , const std::string & k1 , const std::string & k2 ) const
+void CreateSecrets::addSecret( const G::MapFile & p ,
+	const std::string & side , const std::string & k1_in , const std::string & k2 )
 {
 	if( !p.value(k2+"-name").empty() )
 	{
+		// see pages.cpp -- mechanism is "plain", name and secret are base64
+		//std::string mechanism = p.value( k1 ) ; // plain
+		std::string name_base64 = p.value( k2+"-name" ) ;
+		std::string secret_base64 = p.value( k2+"-password" ) ;
+		std::string name_xtext = G::Xtext::encode( G::Base64::decode(name_base64) ) ;
+		std::string secret_xtext = G::Xtext::encode( G::Base64::decode(secret_base64) ) ;
 		if( side == "server" )
 		{
-			std::string head = side + " " + p.value(k1) + " " + p.value(k2+"-name") ; // eg. "server plain joe"
-			std::string tail = p.value(k2+"-password") ; // eg. "secret"
-			content[head] = head + " " + tail ;
+			m_content.push_back( {
+				"server plain:b " + name_base64 ,
+				"server plain " + name_xtext ,
+				"server plain:b " + name_base64 + " " + secret_base64 } ) ;
 		}
 		else
 		{
-			std::string head = side + " " + p.value(k1) ; // eg. "client plain"
-			std::string tail = p.value(k2+"-name") + " " + p.value(k2+"-password") ; // eg. "joe secret"
-			content[head] = head + " " + tail ;
+			m_content.push_back( {
+				"client plain:b" ,
+				"client plain" ,
+				"client plain:b " + name_base64 + " " + secret_base64 } ) ;
 		}
 	}
 }
@@ -766,6 +782,7 @@ std::string CreateSecrets::subject() const
 bool CreateSecrets::match( std::string p1 , std::string p2 )
 {
 	// true if p1 starts with p2
+	if( p2.empty() ) return false ;
 	G::Str::replaceAll( p1 , "\t" , " " ) ;
 	while( G::Str::replaceAll( p1 , "  " , " " ) ) ;
 	G::Str::trimLeft( p1 , G::Str::ws() ) ;
@@ -829,16 +846,16 @@ void CreateSecrets::run()
 		bool replaced = false ;
 		for( auto & line : line_list )
 		{
-			if( match( line , map_item.first ) )
+			if( match(line,map_item.key) || match(line,map_item.key2) )
 			{
-				line = map_item.second ;
+				line = map_item.line ;
 				replaced = true ;
 				break ;
 			}
 		}
 		if( !replaced )
 		{
-			line_list.push_back( map_item.second ) ;
+			line_list.push_back( map_item.line ) ;
 		}
 	}
 
diff --git a/src/gui/pages.cpp b/src/gui/pages.cpp
index 336483b..d2dd469 100644
--- a/src/gui/pages.cpp
+++ b/src/gui/pages.cpp
@@ -701,7 +701,7 @@ void PopPage::dump( std::ostream & stream , bool for_install ) const
 	dumpItem( stream , for_install , "pop-shared-no-delete" , value(m_no_delete_checkbox) ) ;
 	dumpItem( stream , for_install , "pop-by-name" , value(m_pop_by_name) ) ;
 
-	dumpItem( stream , for_install , "pop-auth-mechanism" , std::string("plain:b") ) ;
+	dumpItem( stream , for_install , "pop-auth-mechanism" , std::string("plain") ) ;
 	if( for_install )
 	{
 		dumpItem( stream , for_install , "pop-account-1-name" , G::Base64::encode(value_utf8(m_name_1)) ) ;
@@ -920,7 +920,7 @@ void SmtpServerPage::dump( std::ostream & stream , bool for_install ) const
 	Gui::Page::dump( stream , for_install ) ;
 	dumpItem( stream , for_install , "smtp-server-port" , value(m_port_edit_box) ) ;
 	dumpItem( stream , for_install , "smtp-server-auth" , value(m_auth_checkbox) ) ;
-	dumpItem( stream , for_install , "smtp-server-auth-mechanism" , std::string("plain:b") ) ;
+	dumpItem( stream , for_install , "smtp-server-auth-mechanism" , std::string("plain") ) ;
 	if( for_install )
 	{
 		dumpItem( stream , for_install , "smtp-server-account-name" , G::Base64::encode(value_utf8(m_account_name)) ) ;
@@ -1353,7 +1353,7 @@ void SmtpClientPage::dump( std::ostream & stream , bool for_install ) const
 	dumpItem( stream , for_install , "smtp-client-tls" , value(m_tls_checkbox->isChecked()&&!m_tls_tunnel->isChecked()) ) ;
 	dumpItem( stream , for_install , "smtp-client-tls-connection" , value(m_tls_checkbox->isChecked()&&m_tls_tunnel->isChecked()) ) ;
 	dumpItem( stream , for_install , "smtp-client-auth" , value(m_auth_checkbox) ) ;
-	dumpItem( stream , for_install , "smtp-client-auth-mechanism" , std::string("plain:b") ) ;
+	dumpItem( stream , for_install , "smtp-client-auth-mechanism" , std::string("plain") ) ;
 	if( for_install )
 	{
 		dumpItem( stream , for_install , "smtp-client-account-name" , G::Base64::encode(value_utf8(m_account_name)) ) ;
diff --git a/src/main/emailrelay.rc b/src/main/emailrelay.rc
index 4020899..6e24db7 100644
--- a/src/main/emailrelay.rc
+++ b/src/main/emailrelay.rc
@@ -43,8 +43,8 @@ BEGIN
 END
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 2, 4, 0, 0
- PRODUCTVERSION 2, 4, 0, 0
+ FILEVERSION 2, 4, 1, 0
+ PRODUCTVERSION 2, 4, 1, 0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -62,12 +62,12 @@ BEGIN
             VALUE "Comments", "GPL v3 license"
             VALUE "CompanyName", " "
             VALUE "FileDescription", "E-MailRelay Application"
-            VALUE "FileVersion", "2, 4, 0, 0"
+            VALUE "FileVersion", "2, 4, 1, 0"
             VALUE "InternalName", "emailrelay"
             VALUE "LegalCopyright", "Copyright (C) 2001-2022 Graeme Walker <graeme_walker@users.sourceforge.net>"
             VALUE "OriginalFilename", "emailrelay.exe"
             VALUE "ProductName", "E-MailRelay"
-            VALUE "ProductVersion", "2, 4, 0, 0"
+            VALUE "ProductVersion", "2, 4, 1, 0"
         END
     END
     BLOCK "VarFileInfo"
diff --git a/src/main/run.cpp b/src/main/run.cpp
index 1a1591e..2249bb5 100644
--- a/src/main/run.cpp
+++ b/src/main/run.cpp
@@ -68,7 +68,7 @@ namespace { std::string localedir() { return std::string() ; } }
 
 std::string Main::Run::versionNumber()
 {
-	return "2.4" ;
+	return "2.4.1" ;
 }
 
 Main::Run::Run( Main::Output & output , const G::Arg & arg , bool is_windows , bool has_gui ) :
diff --git a/src/main/submit.cpp b/src/main/submit.cpp
index f08e6fd..635ab16 100644
--- a/src/main/submit.cpp
+++ b/src/main/submit.cpp
@@ -63,7 +63,7 @@
 
 std::string versionNumber()
 {
-	return "2.4" ;
+	return "2.4.1" ;
 }
 
 static std::string writeFiles( const G::Path & spool_dir ,
diff --git a/src/main/testrun.cpp b/src/main/testrun.cpp
index d801f04..53427c0 100644
--- a/src/main/testrun.cpp
+++ b/src/main/testrun.cpp
@@ -87,7 +87,7 @@ namespace { std::string localedir() { return std::string() ; } }
 
 std::string Main::Run::versionNumber()
 {
-	return "2.4" ;
+	return "2.4.1" ;
 }
 
 Main::Run::Unit::Unit( std::size_t unit_id , Run * run , const Configuration & config , int resolver_family ) :