[Dovecot] 1.0rc7 - dumb question
I am configuring dovecot 1.0rc7 to authenticate users (system users)
in /etc/passwd.
Is it possible to use a different auth mechanism, other than "plain",
when the encrypted password is in /etc/master.passwd (BSD style)?
-Wash
http://www.netmeister.org/news/learn2quote.html
DISCLAIMER: See http://www.wananchi.com/bms/terms.php
--
+======================================================================+
|\ _,,,---,,_ | Odhiambo Washington
Odhiambo WASHINGTON wrote:
Is it possible to use a different auth mechanism, other than "plain", when the encrypted password is in /etc/master.passwd (BSD style)?
No, because the other mechanisms require a plaintext password (although I see the WIKI doesn't reflect this except for APOP). As I recommended recently, you are free to use IMAPS (SSL IMAP) with encrypted passwords.
HTH
John
-- John Peacock Director of Information Research and Technology Rowman & Littlefield Publishing Group 4501 Forbes Boulevard Suite H Lanham, MD 20706 301-459-3366 x.5010 fax 301-429-5748
* On 14/09/06 14:44 -0400, John Peacock wrote:
| Odhiambo WASHINGTON wrote:
| >Is it possible to use a different auth mechanism, other than "plain",
| >when the encrypted password is in /etc/master.passwd (BSD style)?
|
| No, because the other mechanisms require a plaintext password (although
| I see the WIKI doesn't reflect this except for APOP). As I recommended
| recently, you are free to use IMAPS (SSL IMAP) with encrypted passwords.
Hi John,
Let me understand this correctly.
You're saying IMAPS will work with a setting such as below??
auth default {
mechanisms = digest-md5
passdb pam {
args = *
}
userdb passwd {
args = /etc/master.passwd
}
If yes, then I am inclined to ask why POP3S would not work with the
same.
Sorry, questions still dumb ;)
-Wash
http://www.netmeister.org/news/learn2quote.html
DISCLAIMER: See http://www.wananchi.com/bms/terms.php
--
+======================================================================+
|\ _,,,---,,_ | Odhiambo Washington
On Thursday 14 September 2006 21:13, Odhiambo WASHINGTON wrote:
Hi Wash,
Hi John,
Let me understand this correctly.
You're saying IMAPS will work with a setting such as below??
auth default { mechanisms = digest-md5 passdb pam { args = * } userdb passwd { args = /etc/master.passwd }
If yes, then I am inclined to ask why POP3S would not work with the same.
Sorry, questions still dumb ;)
The above can't work (for POP or IMAP). For the DIGEST-MD5 auth mechanism to work, Dovecot needs access to the plain text password. However, the password is stored in an encrypted form in /etc/master.passwd. With encrypted password in /etc/master.passwd, you can only use the PLAIN mechanism.
What John was saying is that since the password has to be transmitted in the clear for PLAIN, it's better to use transport-level security, ie. IMAPS and POP3S.
-- Anand
* On 14/09/06 21:20 +0200, Anand Buddhdev wrote:
| On Thursday 14 September 2006 21:13, Odhiambo WASHINGTON wrote:
|
| Hi Wash,
|
| > Hi John,
| >
| > Let me understand this correctly.
| >
| > You're saying IMAPS will work with a setting such as below??
| >
| > auth default {
| > mechanisms = digest-md5
| > passdb pam {
| > args = *
| > }
| > userdb passwd {
| > args = /etc/master.passwd
| > }
| >
| > If yes, then I am inclined to ask why POP3S would not work with the
| > same.
| >
| > Sorry, questions still dumb ;)
|
| The above can't work (for POP or IMAP). For the DIGEST-MD5 auth
| mechanism to work, Dovecot needs access to the plain text password.
| However, the password is stored in an encrypted form
| in /etc/master.passwd. With encrypted password in /etc/master.passwd,
| you can only use the PLAIN mechanism.
|
| What John was saying is that since the password has to be transmitted in
| the clear for PLAIN, it's better to use transport-level security, ie.
| IMAPS and POP3S.
Hi Anand,
Thank you very much for the clarification.
I have a setup where I have both the cleartext password and
encrypted (md5 hash) password in a mysql database.
In this situation it would be possible to use digest-md5, yes?
But this would mean that any user not using secure authentication will fail
to authenticate or is it possible to configure dovecot to start with
a secure auth mechanism, but fall back to some none secure mechanism
in case the default one fails (although it's stupid to do this)?
-Wash
http://www.netmeister.org/news/learn2quote.html
DISCLAIMER: See http://www.wananchi.com/bms/terms.php
--
+======================================================================+
|\ _,,,---,,_ | Odhiambo Washington
Odhiambo WASHINGTON wrote:
I have a setup where I have both the cleartext password and encrypted (md5 hash) password in a mysql database. In this situation it would be possible to use digest-md5, yes?
Yeah, except that DIGEXT-MD5 is much less well supported than CRAM-MD5, so I would have both enabled, or just CRAM-MD5.
But this would mean that any user not using secure authentication will fail to authenticate or is it possible to configure dovecot to start with a secure auth mechanism, but fall back to some none secure mechanism in case the default one fails (although it's stupid to do this)?
Most clients [that I'm aware of] will try to use a stronger authentication method before trying to use a weaker one. If you want to support CRAM-MD5 and PLAIN, you will have to decide whether you want to force users to connect to IMAPS (to protect the plaintext password). Then you can permit both methods, and the client will choose one from the list that the server advertises (as I said, most will choose CRAM-MD5 then PLAIN).
Personally, I only support CRAM-MD5, but I do support IMAP and IMAPS (I also support CRAM-MD5 for outbound mail on SMTP/TLS/SMTPS)...
John
-- John Peacock Director of Information Research and Technology Rowman & Littlefield Publishing Group 4501 Forbes Boulevard Suite H Lanham, MD 20706 301-459-3366 x.5010 fax 301-429-5748
participants (3)
-
Anand Buddhdev
-
John Peacock
-
Odhiambo WASHINGTON