|
From: SourceForge.net <no...@so...> - 2009-02-16 23:43:51
|
Patches item #2607332, was opened at 2009-02-17 00:43 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=937966&aid=2607332&group_id=191583 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Core Group: SVN (please specify revision!) Status: Open Resolution: None Priority: 5 Private: No Submitted By: cmuelle8 (trendypack) Assigned to: Nobody/Anonymous (nobody) Summary: add CRAM-MD5 encrypt option for dovecot users Initial Comment: Hi, please apply the following patch to functions.inc.php. Background: I don't want to store the pws plain. Auth mechanisms supported in dovecot: plain login cram-md5 digest-md5 (crypt-md5 is not supported as an auth mechanism, look at http://wiki.dovecot.org/Authentication/Mechanisms and ). I'm aware that using PLAIN or LOGIN over SSL is a viable option (in this case dovecot does PLAIN to MD5-CRYPT and compares). However, in a non-ssl scenario PLAIN and LOGIN are a bad option and disabled by default in dovecot. Using CRAM-MD5 or DIGEST-MD5 is possible, but then the passwords have to be in CRAM-MD5 format as well (since dovecot can't do CRAM-MD5 to MD5-CRYPT, obviously). The patch below makes this an option for dovecot users. A hint in config.inc.php will probably also be needed (along the comment lines for the other authentication methods). Greetings, cmuelle8 --- functions.inc.php.orig 2009-02-17 00:06:37.000000000 +0100 +++ functions.inc.php.cram-md5 2009-02-17 00:00:23.000000000 +0100 @@ -1126,6 +1126,11 @@ $password = md5($pw); } + if ($CONF['encrypt'] == 'cram-md5') { + $password = shell_exec("dovecotpw -s CRAM-MD5 -p $pw"); + $password = trim(str_replace('{CRAM-MD5}', '', $password)); + } + if ($CONF['encrypt'] == 'system') { if (ereg ("\$1\$", $pw_db)) { $split_salt = preg_split ('/\$/', $pw_db); ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=937966&aid=2607332&group_id=191583 |
