<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><blockquote type="cite" class="">On Jul 19, 2018, at 6:49 PM, J Doe <<a href="mailto:general@nativemethods.com" class="">general@nativemethods.com</a>> wrote:<br class=""><br class="">Hello,<br class=""><br class="">I have a basic e-mail server with Postfix 3.1 and Dovecot 2.2.22.<br class=""><br class="">I am using a passwd-file for both userdb and passdb:<br class=""><br class=""> /etc/dovecot/dovecot.conf<br class=""> userdb {<br class=""> driver = passwd-file<br class=""> args = /etc/dovecot/passwd<br class=""> }<br class=""><br class=""> passdb {<br class=""> driver = passwd-file<br class=""> args = /etc/dovecot/passwd<br class=""> }<br class=""> }<br class=""><br class="">In the passwd file, I want to have user account names for SMTP SASL AUTH and IMAP that are NOT e-mail addresses.<br class=""><br class="">For example, employee one of ABC corp would have a SMTP SASL AUTH/IMAP account name in the form: abc_company_employeeid (for example: abc_company_03284). The idea behind that is that I do not want someone outside of the company to be able to know the first half of the username and password pair just because they have an employee's e-mail address.<br class=""><br class="">For the e-mail address I specify something like: <a href="mailto:bob@abc.com" class="">bob@abc.com</a> however I never want someone to be able to login via their e-mail address. Originally, I specified the password field as empty, with the understanding being that the default encryption of a password is {CRYPT}. Since crypt() cannot output a null string, this meant that there was never a valid password.<br class=""><br class="">So passwd looked like this:<br class=""><br class=""> /etc/dovecot/passwd<br class=""> # SMTP SASL AUTH and IMAP accounts<br class=""> abc_company_03284:::::::userdb_mail=maildir:/var/mail/vhosts/<a href="http://abc.com/abc_company_03284" class="">abc.com/abc_company_03284</a><br class=""><br class=""> # IMAP<br class=""> <a href="mailto:bob@abc.com" class="">bob@abc.com</a>:vmail:vmail::/home/vmail/bob::userdb_maill=maildir:/var/mail/vhosts/<a href="http://abc.com/abc_company_03284" class="">abc.com/abc_company_03284</a><br class=""><br class="">I tested SMTP SASL AUTH and IMAP via the openssl s_client and can confirm that I can login and send e-mail as well as retrieve mail only via the: abc_company_03284 account, but because an empty password field isn’t mentioned on the Dovecot wiki, I was wondering if I should add “nologin” to explicitly make it impossible for: <a href="mailto:bob@abc.com" class="">bob@abc.com</a>. “nologin” was mentioned to me in a previous e-mail to this list.<br class=""><br class="">So passwd would now look like this:<br class=""><br class=""> /etc/dovecot/passwd<br class=""> # SMTP SASL AUTH and IMAP accounts<br class=""> abc_company_03284:::::::userdb_mail=maildir:/var/mail/vhosts/<a href="http://abc.com/abc_company_03284" class="">abc.com/abc_company_03284</a><br class=""><br class=""> # IMAP<br class=""> <a href="mailto:bob@abc.com" class="">bob@abc.com</a>:vmail:vmail::/home/vmail/bob::userdb_mail=maildir:/var/mail/vhosts/<a href="http://abc.com/abc_company_03284" class="">abc.com/abc_company_03284</a> nologin<br class=""><br class="">I restarted Dovecot and tested this with openssl s_client for SMTP SASL AUTH and IMAP, but just wanted to make sure that this STOPS ANY LOGINS via the e-mail address: <a href="mailto:bob@abc.com" class="">bob@abc.com</a> ?<br class=""><br class="">Thanks,<br class=""><br class="">- J<br class=""></blockquote><br class="">Hi list,<br class=""><br class="">I believe I’ve found the solution I’m looking for.<br class=""><br class="">I use one passwd-file for SMTP SASL AUTH, IMAP and LMTP from a Postfix 3.1 server to a Dovecot 2.2.22 server.<br class=""><br class=""> /etc/dovecot/dovecot.conf<br class=""> userdb {<br class=""> driver = passwd-file<br class=""> args = /etc/dovecot/passwd<br class=""> }<br class=""><br class=""> passdb {<br class=""> driver = passwd-file<br class=""> args = /etc/dovecot/passwd<br class=""> }<br class=""> }<br class=""><br class="">The passwd file contains one test user. The test user’s SMTP SASL AUTH and IMAP account name is: “abc_company_03284" and has a password of “password”.<br class="">The e-mail address of that user is "<a href="mailto:bob@abc.com" class="">bob@abc.com</a>". I don’t have the SMTP SASL AUTH and IMAP account name set to “<a href="mailto:bob@abc.com" class="">bob@abc.com</a>" because I don’t want someone to try to login by assuming the SMTP SASL AUTH/IMAP account name is the user’s e-mail address.<div class=""><br class=""> /etc/dovecot/passwd<br class=""> # SMTP SASL AUTH and IMAP information<br class=""> abc_company_03284:{PLAIN}password::::::userdb_mail=maildir:/var/mail/vhosts/<a href="http://abc.com/abc_company_03284" class="">abc.com/abc_company_03284</a><br class=""><br class=""> # LMTP<br class=""> <a href="mailto:bob@abc.com" class="">bob@abc.com</a>:{PLAIN}password:vmail:vmail:/home/vmail/bob::userdb_mail=maildir:/var/mail/vhosts/<a href="http://abc.com/abc_company_03284" class="">abc.com/abc_company_03284</a><br class=""><br class="">If I test logging on via SMTP SASL AUTH and IMAP via the openssl s_client, I can log on using an account name of “<a href="mailto:bob@abc.com" class="">bob@abc.com</a>" and a password of “password”, as expected.</div><div class=""><br class=""></div><div class="">To stop someone from logging on via their e-mail address, I place “fail” [1] at the end INSTEAD OF “nologin”:</div><div class=""><br class=""></div><div class=""> /etc/dovecot/passwd<br class=""> # SMTP SASL AUTH and IMAP information<br class=""> abc_company_03284:{PLAIN}password::::::userdb_mail=maildir:/var/mail/vhosts/<a href="http://abc.com/abc_company_03284" class="">abc.com/abc_company_03284</a><br class=""><br class=""> # LMTP<br class=""> <a href="mailto:bob@abc.com" class="">bob@abc.com</a>:{PLAIN}password:vmail:vmail:/home/vmail/bob::userdb_mail=maildir:/var/mail/vhosts/<a href="http://abc.com/abc_company_03284" class="">abc.com/abc_company_03284</a> fail <br class=""><br class="">If I then restart Postfix and Dovecot and attempt to login via SMTP SASL AUTH and IMAP via the openssl s_client with an account name of “<a href="mailto:bob@abc.com" class="">bob@abc.com</a>” and use a password of “password”, it now fails password lookup in both instances. Because of the “fail” command, the password field I used for testing with the “<a href="mailto:bob@abc.com" class="">bob@abc.com</a>" account is irrelevant and I can remove it. Therefore my final passwd file is:</div><div class=""><br class=""></div><div class=""> /etc/dovecot/passwd<br class=""> # SMTP SASL AUTH and IMAP information<br class=""> abc_company_03284:{PLAIN}password::::::userdb_mail=maildir:/var/mail/vhosts/<a href="http://abc.com/abc_company_03284" class="">abc.com/abc_company_03284</a><br class=""><br class=""> # LMTP<br class=""> <a href="mailto:bob@abc.com" class="">bob@abc.com</a>::vmail:vmail:/home/vmail/bob::userdb_mail=maildir:/var/mail/vhosts/<a href="http://abc.com/abc_company_03284" class="">abc.com/abc_company_03284</a> fail <br class=""><div class=""><br class=""></div><div class="">Sending a test e-mail to “<a href="mailto:bob@abc.com" class="">bob@abc.com</a>” confirms that the user’s e-mail is received and stored in: "/var/mail/vhosts/<a href="http://abc.com/abc_company_03284" class="">abc.com/abc_company_03284</a>”, which means LMTP is working.</div><div class=""><br class=""></div><div class=""><span class="">Can anyone confirm that I am correct about this ? I want to be sure that is now:</span></div><div class=""><span class=""><br class=""></span></div><div class=""><span class=""> 1) Impossible to login via SMTP SASL AUTH and IMAP using the e-mail address “<a href="mailto:bob@abc.com" class="">bob@abc.com</a>”.</span></div><div class=""><span class=""> 2) Only possible to login via SMTP SASL AUTH and IMAP using the account name “abc_company_03284” and a password of “password"</span></div><div class=""><span class=""><br class=""></span></div><div class=""><span class="">Thanks,</span></div><div class=""><span class=""><br class=""></span></div><div class="">- J</div><div class=""><br class=""></div><div class="">Sources:</div><div class=""><br class=""></div><div class="">[1] <a href="https://wiki2.dovecot.org/PasswordDatabase/ExtraFields" class="">https://wiki2.dovecot.org/PasswordDatabase/ExtraFields</a> and see “fail"<br class=""></div></div></div></body></html>