vpopmail

Rick Romero
Thu, 04 Oct 2018 14:42:23 -0000

Quoting Rick Romero <rick at havokmon.com>:

> Quoting Eric Broch <ebroch at whitehorsetc.com>:
>
>> On 10/4/2018 7:27 AM, Rick Romero wrote:
>>> Quoting Eric Broch <ebroch at whitehorsetc.com
>>> <mailto:ebroch at whitehorsetc.com>>:
>>>
>>>> On 10/4/2018 6:34 AM, Rick Romero wrote:
>>>>> ?
>>>
>>> Quoting Aki Tuomi <aki.tuomi at open-xchange.com
>>> <mailto:aki.tuomi at open-xchange.com>>:
>>>
>>>> On 03.10.2018 23:30, Eric Broch wrote:
>>>>
>>>>> Hello list,
>>>>>
>>>>> I run Dovecot with the vpopmail driver and have found that
it
>>>>> authenticates against the clear text password in the
vpopmail
>>>>> database. Is there a configuration option either at compile
time, link
>>>>> time, or a setting in one of the configuration files that
tells the
>>>>> program to authenticate against the hash instead of the
clear text?
>>>>
>>>> Prefix your passwords in vpopmail with {SCHEME} (like,?
{CRYPT})
>>>> Aki
>>>
>>> Or use SQL -? then you don't have to munge any of your tools.
>>>
>>> password_query >>> SELECT CONCAT(pw_name, '@',
pw_domain) AS user, pw_passwd AS
>>> password, pw_dir as userdb_home, 89 as userdb_uid, 89 as userdb_gid
>>> FROM vpopmail WHERE pw_name = '%n' AND pw_domain =
'%d' AND
>>> !(pw_gid & 8) AND !(pw_gid & 2) AND
('%r'!='<webserverip>' or
>>> !(pw_gid & 4))
>>>
>>> pw_gid refers to the the binary vpopmail flags for disable POP,
>>> IMAP, Webmail.
>>>
>>> Rick
>>
>>> When configuring vpopmail for our purposes we use (now) the
>>> configuration option:
>>>
>>> --disable-many-domains? ? ?Creates a table for each virtual domain
>>> instead of storing all users in a single table.
>>> ? ? ? ? ? ? ? ? ? ? ? ? ? ?Only valid for MySQL and PostgreSQL
>>>
>>> This disallows (I think) the use Dovecot MySQL configuration file
>>> as every user is stored in a domain table of the form
>>> 'mydomain_tld'.
>>>
>>> So, we're limited to these configurations (no
dovecot-mysql.conf.ext) :
>>>
>>> passdb {
>>> args = cache_key=%u webmail=127.0.0.1
>>> driver = vpopmail
>>> }
>>>
>>> userdb {
>>> args = cache_key=%u quota_template=quota_rule=*:backend=%q
>>> driver = vpopmail
>>> }
>>>
>>> If there is a clear text password (pw_clear_passwd) present it
>>> seems that Dovecot will use that instead of using the hash
>>> (pw_passwd).
>>>
>>> It seems that in the code 'passdb-vpopmail.c' (below) that
if the
>>> clear password (pw_clear_passwd) is present Dovecot skips the
>>> hashed password (pw_passwd), and we want authentication against
>>> the hashed password.
>>>
>>> <snippet>
>>> ? ? ? ?if (vpopmail_is_disabled(auth_request, vpw)) {
>>> ? ? ? ? ? ? ? ?auth_request_log_info(auth_request, AUTH_SUBSYS_DB,
>>> ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?"%s disabled in vpopmail
for
>>> this user",
>>> ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?auth_request->service);
>>> ? ? ? ? ? ? ? ?password = NULL;
>>> ? ? ? ? ? ? ? ?*result_r = PASSDB_RESULT_USER_DISABLED;
>>> ? ? ? ?} else {
>>> ? ? ? ? ? ? ? ?if (vpw->pw_clear_passwd != NULL &&
>>> ? ? ? ? ? ? ? ? ? ?*vpw->pw_clear_passwd != '\0') {
>>> ? ? ? ? ? ? ? ? ? ? ? ?password =
t_strdup_noconst(vpw->pw_clear_passwd);
>>> ? ? ? ? ? ? ? ? ? ? ? ?*cleartext = TRUE;
>>> ? ? ? ? ? ? ? ?} else if (!*cleartext)
>>> ? ? ? ? ? ? ? ? ? ? ? ?password =
t_strdup_noconst(vpw->pw_passwd);
>>> ? ? ? ? ? ? ? ?else
>>> ? ? ? ? ? ? ? ? ? ? ? ?password = NULL;
>>> ? ? ? ? ? ? ? ?*result_r = password != NULL ? PASSDB_RESULT_OK :
>>> ? ? ? ? ? ? ? ? ? ? ? ?PASSDB_RESULT_SCHEME_NOT_AVAILABLE;
>>> ? ? ? ?}
>>> </snippet>
>>>
>>> Looking for an option to make dovecot use hashed password instead
>>> of clear text.
>>>
>>> Hope this makes sense.
>>>
>>> -EricB
>>>
>>> We seem to have lost quoting..
>>> First - Why aren't you just deleting all the clear text
passwords?
>>>
>>> Second, for many domanis, my password query for your purposes
>>> should just be:
>>> SELECT CONCAT(pw_name, '@', pw_domain) AS user, pw_passwd
AS
>>> password, pw_dir as userdb_home, 89 as userdb_uid, 89 as userdb_gid
>>> FROM %d WHERE pw_name = '%n' AND pw_domain = '%d'
AND !(pw_gid &
>>> 8) AND !(pw_gid & 2) AND
('%r'!='<webserverip>' or !(pw_gid & 4))
>>>
>>> Where %d is the domain name. Your vpopmail database should have a
>>> bunch of domain.com table names.
>>> Or you can hardcode the database with? ?FROM vpopmail.%d
>>> You may need to play with quotes..? FROM `vpopmail.%d`? or? FROM
`%d`
>>>
>>> Rick
>>
>> Rick,
>>
>> I'm not sure what you're saying.
>>
>> Vpopmail's DB can be configured in two different ways, 1) With
>> domain tables and all users for that particular domain underneath
>> (described below), or 2) Simply, one table with all users with the
>> domain field 'pw_domain' (This works with dovecot-sql.conf.ext
>> files). The former (1), which we use does not allow the use of
>> dovecot-sql.conf.ext files, we're limited to userdb and passwd
>> options previously mentioned. When using these options dovecot will
>> get the clear text password if present.
>>
>> The problem is that if a password is over 16 characters long the
>> clear text field will only store the first 16 characters while the
>> hashed field will contain the whole password.
>>
>> # echo "describe domain_tld" | mysql -u root -p`cat
vpoppasswd` vpopmail
>> yeilds
>> Field? ?Type? ? Null? ? Key? ? ?Default Extra
>> pw_name char(32)? ? ? ? NO? ? ? PRI? ? ?NULL
>> pw_passwd? ? ? ?char(40)? ? ? ? YES? ? ? ? ? ? ?NULL
>> pw_uid? int(11) YES? ? ? ? ? ? ?NULL
>> pw_gid? int(11) YES? ? ? ? ? ? ?NULL
>> pw_gecos? ? ? ? char(48)? ? ? ? YES? ? ? ? ? ? ?NULL
>> pw_dir? char(160)? ? ? ?YES? ? ? ? ? ? ?NULL
>> pw_shell? ? ? ? char(20)? ? ? ? YES? ? ? ? ? ? ?NULL
>> pw_clear_passwd char(16)? ? ? ? YES? ? ? ? ? ? ?NULL
>>
>> As you can see there is no 'pw_domain' field from which to
draw.
>>
>> Again we are limited to the passdb, and userdb options already
described.
>
> I'm not sure why #1 wouldn't work with a proper query - here's
the
> same without a reference to pw_domain at all.
>
> SELECT CONCAT(pw_name, '@', %d) AS user, pw_passwd AS? password,
> pw_dir as userdb_home, 89 as userdb_uid, 89 as userdb_gid FROM %d
> WHERE pw_name = '%n' AND pw_domain = '%d' AND !(pw_gid
& 8) AND
> !(pw_gid & 2) AND ('%r'!='<webserverip>' or
!(pw_gid & 4))
>
> Alternatively if you absolutely must have clear text password, and
> it has to be greater than 16 characters, make the MySQL field bigger
> than 16 characters.? 'Alter table' is the command.
>
> It really sounds to me like you need a test environment.
> Rick

Dammit

SELECT CONCAT(pw_name, '@', %d) AS user, pw_passwd AS? password,
pw_dir as userdb_home, 89 as userdb_uid, 89 as userdb_gid FROM %d
WHERE pw_name = '%n' AND !(pw_gid & 8) AND !(pw_gid & 2) AND
('%r'!='<webserverip>' or !(pw_gid & 4))
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20181004/d32ba329/attachment-0001.html>