On Tue, 14 Feb 2017, KT Walrus wrote:
Another related security situation I've encountered is when a fraudster has phished a user's password. A user/admin changes the password, but forgets to invalidate dovecot's cached entry, allowing the fraudster contunuing access to the mail account until the TTL expires or user logs in with new credentials. I've been burnt by this one.
I?m no expert, but should the code that updates the password hash in the database also immediately try to log into dovecot for the user with a fake password?
Authentication should fail but the cache would be updated?
I guess you could write a hook for that, but that's not a scalable solution if your auth database is used by many different services that do their own credential caching.
I do this manually i.e. if I have to invalidate mail system cache, I log in with wrong credentials.
Or, doesn?t Dovecot expire the cache?d entry on failed authentication?
Dovecot does have a auth_cache_negative_ttl setting.
I think the best proactive approach is to keep auth_cache_ttl modest (a few minutes) rather than hours or days.
Joseph Tam <jtam.home@gmail.com>