Bert Koelewijn wrote:
Andreas Jaekel wrote:
Aloha!
At 12:37 01/10/2003 +0200, Bert Koelewijn wrote:
Dear Timo,
most modern enterprises make use of a Public Key Infrastructure. It would be nice to have dovecot check a client certificate instead of a password. This makes life much easier and more secure. Mail clients like Mozilla and MS Outlook do support this. What do you think of the following feature request:
- Client authenticates with a certificate via SSL. (Like stunnel can)
- Dovecot looks the username up in a table with (public key, username)
- The mailclient gives a name and password, but dovecot ignores them
- Dovecot gives the client access by the username found in the table
This way existing mail clients can use this system and you can save your username with an empty password.
Wouldn't it be much better to take the list of valid usernames from X.509 extension fields instead of a lookup table? That way the usernames are also verified and trusted information.
dovecot-auth would then allow the client to log in with any of the certified usernames using any arbitrary password, or to additional usernames using the correct password.
Of course, one could also use attribute certificates... :)
Anyway, one thing to remember might be that a ceritifcate usually identifies a person, not an account, so if a lookup table is used it should allow the person to have more than one account, and dovecot should allow that person into any one of them. Which one the person wants would be indicated by the username given to LOGIN.
Regards, Andy
Yep, you're totally right. In our company everybody has 1 mailbox, then one could use X.509 extensions.
Thanks!
Bert
If you don't use a lookup table, you HAVE to implement CRL's! You can make a script to download a new CRL and set it in your cron tabs.
Regards,
Bert