dovecot - Feb 2010 - [AUTH] Extra @ in user and empty passwd with CRAM-MD5

Hi,

I got problem whith CRAM-MD5 auth (works fine with PLAIN):

------------------------------------------------------------------------------
Feb 20 13:15:02 auth(default): Info: new auth connection: pid=5026
Feb 20 13:15:06 auth(default): Info: client in: AUTH 1 CRAM-MD5 
service=imap secured lip=87.98.131.8 rip=82.245.64.126  lport=143 rport=1130
Feb 20 13:15:06 auth(default): Info: client out: CONT 1 
PDI5NzIzNTE1MTI1MTA3NjAuMTI2NjY2ODEwNkBkZXY+
Feb 20 13:15:07 auth(default): Info: client in: CONT 1 
dG9vcm9wQHJlc3B1YmxpY2EuZnIgOTczNjdjMzE3NWE1MWY2YzJhNDY0OTNlNDMzZGZhZDQFeb 20
13:15:07 auth(default): Info:
vpopmail(toorop at domain.tld,82.245.64.126): lookup user=toorop 
domain=domain.tld
Feb 20 13:15:07 auth(default): Info: 
password(toorop at domain.tld,82.245.64.126): Generating CRAM-MD5 from user 
'toorop at domain.tld@', password ''
Feb 20 13:15:07 auth(default): Info: 
password(toorop at domain.tld,82.245.64.126): Credentials: 
00747cf2ffaf11c5ea4a64979c3901fc1d20dee13f480bb598f7d8575b23e61b
Feb 20 13:15:07 auth(default): Info: 
cram-md5(toorop at domain.tld,82.245.64.126): password mismatch
Feb 20 13:15:09 auth(default): Info: client out: FAIL 1 
user=toorop at domain.tld
Feb 20 13:15:14 imap-login: Info: Aborted login (auth failed, 1 
attempts): user=<toorop at domain.tld>, method=CRAM-MD5,
rip=82.245.64.126,
lip=87.98.131.8, TLS
----------------------------------------------------------------------------

This line seems strange:
Feb 20 13:15:07 auth(default): Info: 
password(toorop at domain.tld,82.245.64.126): Generating CRAM-MD5 from user 
'toorop at domain.tld@', password ''

=> Why extra @ in user and empty password ??


Client: Thundebird 2.0.0.23

vpopmail version: 5.4.16

dovecot -n
# 1.2.6: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.24-8-pve i686 Gentoo Base System release 1.12.11.1
log_path: /var/log/dovecot.log
protocols: imap imaps pop3 pop3s
disable_plaintext_auth: no
login_dir: /var/run/dovecot/login
login_executable(default): /usr/libexec/dovecot/imap-login
login_executable(imap): /usr/libexec/dovecot/imap-login
login_executable(pop3): /usr/libexec/dovecot/pop3-login
mail_max_userip_connections(default): 5
mail_max_userip_connections(imap): 5
mail_max_userip_connections(pop3): 10
verbose_proctitle: yes
first_valid_uid: 89
last_valid_uid: 89
first_valid_gid: 89
last_valid_gid: 89
mail_location: maildir:~/.maildir
maildir_copy_preserve_filename: yes
mail_executable(default): /usr/libexec/dovecot/imap
mail_executable(imap): /usr/libexec/dovecot/imap
mail_executable(pop3): /usr/libexec/dovecot/pop3
mail_plugins(default): quota imap_quota
mail_plugins(imap): quota imap_quota
mail_plugins(pop3):
mail_plugin_dir(default): /usr/lib/dovecot/imap
mail_plugin_dir(imap): /usr/lib/dovecot/imap
mail_plugin_dir(pop3): /usr/lib/dovecot/pop3
lda:
   postmaster_address: postmaster at domain.tld
   hostname: dev.domain.eu
   mail_plugin_dir: /usr/lib/dovecot/lda
   mail_plugins: sieve
   sendmail_path: /usr/lib/sendmail
   auth_socket_path: /var/run/dovecot/auth-master
auth default:
   mechanisms: plain login cram-md5
   verbose: yes
   debug: yes
   debug_passwords: yes
   passdb:
     driver: vpopmail
   userdb:
     driver: vpopmail
   socket:
     type: listen
     client:
       path: /var/run/dovecot/auth-client
       mode: 432
     master:
       path: /var/run/dovecot/auth-master
       mode: 438
plugin:
   sieve: ~/.dovecot.sieve
   sieve_storage: ~/sieve


Thanks,


-- 
Toorop

On Sat, 2010-02-20 at 13:56 +0100, Toorop wrote:
> password(toorop at domain.tld,82.245.64.126): Generating CRAM-MD5 from user
> 'toorop at domain.tld@', password ''
The @ thing is .. well, probably a bug, but it doesn't matter in this
case anyway. The problem is that password is empty. It's because
vpopmail didn't return a plaintext password. Are your passwords stored
in plaintext?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20100222/2c9b267a/attachment-0002.bin>

Timo Sirainen a ?crit :

>> password(toorop at domain.tld,82.245.64.126): Generating CRAM-MD5 from
user
>> 'toorop at domain.tld@', password ''
> The @ thing is .. well, probably a bug, but it doesn't matter in this
> case anyway. The problem is that password is empty. It's because
> vpopmail didn't return a plaintext password. Are your passwords stored
> in plaintext?
Hum... no....

Thanks Timo ;)

-- 
Toorop