dovecot - Oct 2018 - vpopmail

Hello list,

I run Dovecot with the vpopmail driver and have found that it 
authenticates against the clear text password in the vpopmail database. 
Is there a configuration option either at compile time, link time, or a 
setting in one of the configuration files that tells the program to 
authenticate against the hash instead of the clear text?

-- 
Eric Broch
White Horse Technical Consulting (WHTC)

On 03.10.2018 23:30, Eric Broch wrote:
> Hello list,
>
> I run Dovecot with the vpopmail driver and have found that it
> authenticates against the clear text password in the vpopmail
> database. Is there a configuration option either at compile time, link
> time, or a setting in one of the configuration files that tells the
> program to authenticate against the hash instead of the clear text?
>
Prefix your passwords in vpopmail with {SCHEME} (like,? {CRYPT})

Aki

Quoting Aki Tuomi <aki.tuomi at open-xchange.com>:
> On 03.10.2018 23:30, Eric Broch wrote:
>> Hello list,
>>
>> I run Dovecot with the vpopmail driver and have found that it
>> authenticates against the clear text password in the vpopmail
>> database. Is there a configuration option either at compile time, link
>> time, or a setting in one of the configuration files that tells the
>> program to authenticate against the hash instead of the clear text?
>
> Prefix your passwords in vpopmail with {SCHEME} (like,? {CRYPT})
> Aki
Or use SQL -? then you don't have to munge any of your tools.

password_query SELECT CONCAT(pw_name, '@', pw_domain) AS user, pw_passwd
AS password,
pw_dir as userdb_home, 89 as userdb_uid, 89 as userdb_gid
FROM vpopmail WHERE pw_name = '%n' AND pw_domain = '%d' AND
!(pw_gid &
8) AND !(pw_gid & 2) AND ('%r'!='<webserverip>' or
!(pw_gid & 4))

pw_gid refers to the the binary vpopmail flags for disable POP, IMAP, Webmail.

Rick
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20181004/403cf005/attachment.html>