[Dovecot] checkpassword migration script in Python

Hey all,

First post to the list, so here goes, hope I don't break any rules (I
didn't see any rules about not being overly verbose)

I spent a long time looking for anything that would help me migrate
from our old IMAP server to our new one without a lot of client-side
fuss, multiple e-mail accounts, and so on. I find that a lot of our
users get confused by having two 'inboxes' in Outlook (one local,
unused, and one IMAP), so I figured the easier I could make it, the
better.

I figured there must be some way to do what I was looking for, but I
couldn't find it, so I hacked up a little something to do the job. As
the saying goes, it's nasty, brutish, and short, but in my tests it's
done everything I needed it to.

The problem: Our old mail system is hosted by another company,
outsourced before I was hired, so I don't have access to the old user/ passwd database, nor to their e-mail store; thus, I cannot do a clean,
simple migration by upgrading in-place as I have done on other servers.

The solution IMAP authentication proxying. The idea is that I don't
need to know the password, because the user's mail client knows the
password, so all I need is for it to tell me, and then I can create
their user. That is what this script is for.

To use, set up your authentication backend (passdb) first, and then
after that section, add a 'passdb checkpassword' section containing
this script. Thus, the following will happen.

1. Valid users who log into your system will be authenticated as you
   would expect.
2. Users who could not be authenticated will fall through to the
   checkpassword section
3. Checkpassword will look for the user in the password database; if
   they exist, it is assumed that it is a valid user, but incorrect
   password, and checkpassword fails the user as well.
4. If the user is not currently in the database, it will initiate an
   IMAP4 connection to the remote host specified. If it succeeds in
   logging in to the remote host, then we assume that the user is a valid
   user and can be migrated to the local server. They are added to the
   database, along with their password. It then **fails the user's login
   regardless**
5. It /logs the username and password into the database/ so that
   another process can use that information to migrate their e-mail over
   to the new server (not yet implemented).
6. If the IMAP connection fails, the login is failed as well, and
   dovecot continues as normal until it has exhausted all other passdb
   backends.

Interested? A few things to note about the script:

1. It's a brutal hack. Really, ugly stuff. However, it gets the job
   done, if your system is similar enough to mine.
2. It only works on MySQL. I only use MySQL in our system, so there's
   no point for me to add other DBs, nor any way to test.
3. It doesn't support remote servers using SSL. Our current system
   doesn't use it, so again, it's hard to test.
4. It does not currently migrate mailboxes. I'm working on this (see
   below).
5. If your schema is at all different from mine, you will likely have
   to rewrite all of the SQL. There's not much I can do about this.
6. If your backend database doesn't use MySQL, you're largely boned.
   Exception: rewrite add_user() to do whatever you need to do to add
   users to your system.
7. The script will **ALWAYS RETURN A FAILED LOGIN TO DOVECOT**. This
   is because there are too many variables on every configuration, and
   writing code for all of them is absurd. This way, the user's first
   login will always fail, and their second login will always succeed. If
   you want to avoid this, place your normal passdb authentication **both
   before and after this checkpassword section**. That way, it will check
   once, fail, pass to checkpassword, and then check again, success.

TODO: the user's old mailboxes over. This would be very site-dependent, as

1. Make it not ugly. Break more junk off into functions (e.g. IMAP
   verification)
2. Send the user an e-mail ('Welcome to the server, sorry your mail is
   gone, we'll fix that soon')
3. Spawn another process to run imapsync in the background to migrate

there are a lot of variables. It might be best done as a cronjob that
polls the database every however often (1 minute? 2 minutes?) or a
daemon that sits in the background watching the db for changes, or
even accepting the data directly. 4. Stop being so verbose in my first postings to mailing lists. 5. Lots of other things.

URLS

Blah blah blah where's the code. Here you go.

Pretty syntax-highlighted version for browsing before you download, in
case I'm an evil hacker: http://cdslash.net/temp/python/checkpassword.py Ugly monochrome version for downloading so you don't get line numbers
in your junk: http://cdslash.net/temp/python/checkpassword.raw

Questions, comments? I probably won't be on the list very long, so if
you want to ask something or have a suggestion, feel free to let me
know by e-mail at the address listed in the file's license
notification. Alternately, find me on Freenode, occasionally in
#dovecot or always in #macosx, as Darien, or some variant thereof.

PS: The code is licensed under a boilerplate MIT license lifted from
the OSI license page. If you want it under a different license, let me
know. ;)

Thanks, Dan