Moving to new password scheme

[KSB]

On 2017.01.25. 10:09, Alessio Cecchi wrote:
> Il 24/01/2017 23:29, @lbutlr ha scritto:
>> dovecot is setup on a system with MD5-CRYPT password scheme for all
>> users, and I would like to update this to something that is secure,
>> probably SSHA256-CRYPT, but I want to do this seamlessly without the
>> users having to jump through any hoops.
>>
>> The users are in mySQL (managed via postfixadmin) and the mailbox
>> record simply stores the hash in the password field. Users access
>> their accounts though IMAP MUAs or Roundcube.
>>
>> How would I setup my system so that if a user logs in and still has a
>> $1$ password (MD5-CRYPT) their password will be encoded to the new
>> SHCEME and then the SQL row updated with the $5$ password instead?
>> Something where they are redirected after authentication to a page
>> that forces them to renter their password (or choose a new one) is
>> acceptable.
>>
>> And, while I am here, is it worthwhile to set the -r flag to a large
>> number (like something over 100,000 which sets takes about 0.25
>> seconds to do on my machine)?
>>
> Hi,
>
> you can convert password scheme during the login:
>
> http://wiki2.dovecot.org/HowTo/ConvertPasswordSchemes
>
> Ciao
>

I've done it with nice and short pg's stored procedure.

--
KSB