[Dovecot] dovecot auth is case insensitive, but fs is sensitive :)
others have found this problem ?
this possible bug can be used by user in that way that one password
login can use 2 maildirs in filesystem effitively give them all space
qoutas and lost of other goodies
so to speak:
foo@example.com with a password can login with fOO@example.com and
fOo@example.com
add more chars to get more mailbox :/
confirms ?
i found the problem when i had horde installed
dovecot 1.1.7
-- xpoint
On Aug 19, 2009, at 1:37 AM, Benny Pedersen wrote:
others have found this problem ?
Dovecot auth isn't case-insensitive. But MySQL is, and I guess you're
using it? There are several different ways around it.
On Wed, 2009-08-19 at 01:41 -0400, Timo Sirainen wrote:
On Aug 19, 2009, at 1:37 AM, Benny Pedersen wrote:
others have found this problem ?
Dovecot auth isn't case-insensitive. But MySQL is, and I guess you're
using it? There are several different ways around it.
Which is not a problem since most (all) MTA's normally treat user@ as case insensitive.
Only an incompetently written portal or mail-management script/software/setup would allow a user foo@ *and then* allow FOO@ or Foo@ etc to be added.
If you use management software that does that, dump it, and if it's in-house written, I'd kick the programmers ass for allowing it to be so poorly designed in the first place.
RFC2821 The local-part of a mailbox MUST BE treated as case sensitive. Therefore, SMTP implementations MUST take care to preserve the case of mailbox local-parts. Mailbox domains are not case sensitive. In particular, for some hosts the user "smith" is different from the user "Smith".
However, exploiting the case sensitivity of mailbox local-parts impedes interoperability and is discouraged. ^^^^^^^^^^^^^^^^^ So although permitted, it is only a fool that actually does it.
Actually that isn't the issue. The issue is like one I had with ldap,
till I modified it to be case sensitive. And that is, atleast in my
old pre-1.0 version of dovecot, it would authenicate the user with
mixed or uppercase letters, then use that username for the mailpath.
Since the mailpath is case sensitive, it would respond to the user
saying they have no email, cause the path isn't found. But in reality
they have email, in the all lower case letter version of their username.
My fix was to adjust the ldap schema to have case sensitivty, and then
add for user idiot proofing, force usernames to lowercase in horde.
Quoting Noel Butler noel.butler@ausics.net:
On Wed, 2009-08-19 at 01:41 -0400, Timo Sirainen wrote:
On Aug 19, 2009, at 1:37 AM, Benny Pedersen wrote:
others have found this problem ?
Dovecot auth isn't case-insensitive. But MySQL is, and I guess you're using it? There are several different ways around it.
Which is not a problem since most (all) MTA's normally treat user@ as case insensitive.
Only an incompetently written portal or mail-management script/software/setup would allow a user foo@ *and then* allow FOO@ or Foo@ etc to be added.
If you use management software that does that, dump it, and if it's in-house written, I'd kick the programmers ass for allowing it to be so poorly designed in the first place.
RFC2821 The local-part of a mailbox MUST BE treated as case sensitive. Therefore, SMTP implementations MUST take care to preserve the case of mailbox local-parts. Mailbox domains are not case sensitive. In particular, for some hosts the user "smith" is different from the user "Smith".
However, exploiting the case sensitivity of mailbox local-parts impedes interoperability and is discouraged. ^^^^^^^^^^^^^^^^^ So although permitted, it is only a fool that actually does it.
On ons 19 aug 2009 15:31:39 CEST, Patrick Domack wrote
My fix was to adjust the ldap schema to have case sensitivty, and
then add for user idiot proofing, force usernames to lowercase in
horde.
could you mail me that config to horde ?, but still i also like to
make a better dovecot.conf if its possible so it will say user unknown
instaed of just accept case insensitive on auth
-- xpoint
On ons 19 aug 2009 22:39:02 CEST, Benny Pedersen wrote
could you mail me that config to horde ?, but still i also like to
make a better dovecot.conf if its possible so it will say user
unknown instaed of just accept case insensitive on auth
just to the mail archives, i sorted this problem with auth case error
with upgrade from 1.1.7 to 1.1.16, no more problems with 2 fs users pr
mysql auth
super, keep up the good work all
-- xpoint
Noel Butler noel.butler@ausics.net writes:
On Wed, 2009-08-19 at 01:41 -0400, Timo Sirainen wrote:
Dovecot auth isn't case-insensitive. But MySQL is, and I guess you're
using it? There are several different ways around it.Which is not a problem since most (all) MTA's normally treat user@ as case insensitive.
But the username in the authentication db is completely independent of any localpart that might be used to deliver to a mailbox - access to which is authenticated by providing creds for that username.
I don't see how the fact that MTAs may or may not consider localparts to be case-sensitive has any bearing on the case-sensitivity of usernames stored in the authentication database.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Wed, 19 Aug 2009, pod wrote:
But the username in the authentication db is completely independent of any localpart that might be used to deliver to a mailbox - access to which is authenticated by providing creds for that username.
I don't see how the fact that MTAs may or may not consider localparts to be case-sensitive has any bearing on the case-sensitivity of usernames stored in the authentication database.
I understood the problem so:
If you construct the path in the local file system from the username derived from the local part, you need to be prepared to handle different case names, hence, use %L modifier or return a new spelling from the auth DB.
E.g. recipient addresses: fore.surname@example.com, FORE.surname@example.com ...
mail_location = maildir:/var/mail/%u/Maildir
Bye,
Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBSowLW3WSIuGy1ktrAQLa1gf+PHG8AcZbHluLS32GvE7imIQJrLV0UJ2k 4rHwm0eaOi0EH5sy9LqThyc2ooeqlI9hds3PFzS3EUMpXOLS7sm794x1KbHY8E1L yTLRLi+Lfb/u4Ahsz6+xWddL7zZ7NQA3RGxX5qdXidzjJzkECseGT6E15e/PpcJ5 HOivl9v5YREy0ZFU7TmNgXb5pDxXD9z9SkTWlr8StyYPi2yaeB8m1qUo6YI+OKB4 5iL7VhRrDvsxgHCBhaqIXAjO1woeB+8xAjpi/qXRdWwb2pqrEj43YhscMteidLay YQM5NzFDy0nxi3EC5zIi2EZlD7pwPKOk1astInhPLLIe05LtX3vkJg== =oOud -----END PGP SIGNATURE-----
participants (6)
-
Benny Pedersen
-
Noel Butler
-
Patrick Domack
-
pod
-
Steffen Kaiser
-
Timo Sirainen