VMAIL mysql auth + MD5 passwords

[Andy Smith-14]

Hi,

  Im attemtping to configure courier imap for the first time and coming from

any existing working tpop3d vmail configuration using MySQL.
So I have a MySQL table for users with the following fields:

+---------------+--------------+------+-----+---------+-------+
| Field         | Type         | Null | Key | Default | Extra |
+---------------+--------------+------+-----+---------+-------+
| domain_name   | varchar(255) | NO   | PRI |         |       |
| local_part    | varchar(255) | NO   | PRI |         |       |
| password_hash | varchar(255) | YES  |     | NULL    |       |
| mbox_name     | varchar(255) | YES  |     | NULL    |       |
+---------------+--------------+------+-----+---------+-------+

The password fields have MD5 passwords stored and look like:
{md5}177b8fafcf4d5454f605c563e212f156

But Im not sure this will work with courier from what I read, the docs state
that
MD5 passwords have to be stored in clear text in MySQL. Any advice from
anyone
as to whether I can use my existing MySQL table for auth or will I have to
recreate
passwords for every user?
Also the default MySQL config in courier has many more fields, can I get
away with
just these four fields as used by tpop3d?

thanks for any comments! Andy.


________________________________________________
Message sent using UK Grid Webmail 2.7.9



-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
Courier-imap mailing list
Courier-imap@...
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-imap

[Sam Varshavchik]

Andy Smith writes:

> +---------------+--------------+------+-----+---------+-------+
> | Field         | Type         | Null | Key | Default | Extra |
> +---------------+--------------+------+-----+---------+-------+
> | domain_name   | varchar(255) | NO   | PRI |         |       |
> | local_part    | varchar(255) | NO   | PRI |         |       |
> | password_hash | varchar(255) | YES  |     | NULL    |       |
> | mbox_name     | varchar(255) | YES  |     | NULL    |       |
> +---------------+--------------+------+-----+---------+-------+
>
> The password fields have MD5 passwords stored and look like:
> {md5}177b8fafcf4d5454f605c563e212f156
>
> But Im not sure this will work with courier from what I read, the docs state
> that
> MD5 passwords have to be stored in clear text in MySQL. Any advice from

That's for challenge-response authentication. For normal password
authentication, this is fine.

> anyone
> as to whether I can use my existing MySQL table for auth or will I have to
> recreate
> passwords for every user?
> Also the default MySQL config in courier has many more fields, can I get
> away with
> just these four fields as used by tpop3d?

No, at the minimum, userid and groupid are also required. You will need to
specify a custom query for two reasons, namely because you store the login
ID in two separate fields, instead of storing a userid@domain in a single
field; and you'll also need to return a uid and gid.  See
MYSQL_SELECT_CLAUSE.




-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
Courier-imap mailing list
Courier-imap@...
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-imap

[Brian Candler]

On Fri, Jun 27, 2008 at 10:59:02AM +0100, Andy Smith wrote:
> The password fields have MD5 passwords stored and look like:
> {md5}177b8fafcf4d5454f605c563e212f156
>
> But Im not sure this will work with courier from what I read, the docs state
> that
> MD5 passwords have to be stored in clear text in MySQL.

No, but they have to be stored base64-encoded, not hex-encoded as you have.
It's fairly straightforward to convert one to the other (assuming your
md5 value is a plain unsalted hash of the original password)

e.g. using ruby:

irb(main):001:0> [["177b8fafcf4d5454f605c563e212f156"].pack("H*")].pack("m").strip
=> "F3uPr89NVFT2BcVj4hLxVg=="

That is, try "{md5}F3uPr89NVFT2BcVj4hLxVg==" in the database.

You might be able to knock up something in mysql which does the conversion
dynamically, e.g. with a user-defined function.

Alternatively, you could look at modifying courier-authlib to accept both
hex and base64 passwords, based on the length seen (24 or 32 characters).
This is what exim does.

Regards,

Brian.

-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
Courier-imap mailing list
Courier-imap@...
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-imap