auxprop 不支持md5crypt类型的加密？

iheaing

我安装的版本是
cyrus-sasl-2.1.23
postfix-2.6.5,1
postfixadmin-2.3_1

用户是通过 postfixadmin 添加到 pgsql 数据库中的，密码保存为类似 $1$86fa88b8$0rSw07ELxbMZSudFtGlzx0 这样的字符串。

问题表现为：
telnet 登陆到 25 端口，当数据库中保存的密码是加密时，认证失败。不加密保存时，认证成功。

如何让它支持密码加密？

/usr/local/lib/sasl2/smtpd.conf 文件内容为：

1. 
   
2. pwcheck_method: auxprop
   
3. log_level: 3
   
4. mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD5
   
5. auxprop_plugin: sql
   
6. sql_engine: pgsql
   
7. sql_hostnames: 192.168.1.2
   
8. sql_user: mail
   
9. sql_passwd: mail123
   
10. sql_database: pmail
    
11. sql_select: SELECT password FROM mailbox WHERE username = '%u@%r' AND active = true
    

复制代码

/usr/local/etc/postfix/main.cf 文件中的一部分：

1. 
   
2. smtpd_sasl_auth_enable = yes
   
3. smtpd_sasl_authenticated_header = yes
   
4. smtpd_sasl_security_options = noanonymous
   
5. broken_sasl_auth_clients = yes
   
6. smtpd_recipient_restrictions = permit_sasl_authenticated permit_auth_destination reject
   
7. smtpd_client_restrictions = permit_sasl_authenticated
   
8. smtpd_sender_restrictions = permit_sasl_authenticated
   
9. smtpd_sasl_path = smtpd
   

复制代码

scyzxp

Cyrus-SASL 2.1.x patches

NOTE from pieps: This page is mirrored from http://frost.ath.cx/software/cyrus-sasl-patches, AND is the property of the author.
His site was down occasionally, so I've mirrored it here for convenience.
If there's something wrong with this page, AND not with Brane's, feel free to email me at nick (at) pieps (dot/period) org

The following software is provided for free. You can do with it, whatever you want. Software is provided "AS IS", without any warranty at all (including the implied warranties of merchantability AND fitness for a particular purpose).

If you like this piece of software, send me a postcard from somewhere
Snail mail address:
Branko F. Gracnar
Rakitovec 13
3263 Gorica pri Slivnici
Slovenia
Europe

Available patches:
checkpw.c

This patch makes cyrus-sasl to authenticate crypt(3) hashed passwords from various backends (auxprop plugins) - so you can authenticate crypt hashed passwords in your sql database (this is probably why are you reading this homepage).

Patch adds the following plugin configuration directive:

    * password_format: [plaintext|crypt|crypt_trad]

Installation

    *
          o Download cyrus-sasl-2.1.x.tar.gz from ftp://ftp.ANDrew.cmu.edu/pub/cyrus-mail/ (Also downloadable locally, here)
          o Download checkpw.c patch from download page
          o Unpack distribution (tar zxf cyrus-sasl-2.1.x.tar.gz)
          o Enter source directory (cd cyrus-sasl-2.1.x)
          o Apply patch (patch -p0 < ../cyrus-sasl-2.1.x-checkpw.c.patch)
          o Run configure (./configure)
          o Compile it (make)
          o Install it (make install)
    * FreeBSD ports collection
          o Download FreeBSD version of checkpw.c patch from download page
          o Put patch files in directory /usr/ports/security/cyrus-sasl2/files

Configuration

Configuration directive can be set to the following values:

    * plaintext - passwords are stored in plaintext format - this is default
    * crypt - passwords are stored as modular crypt hashes (md5 or blowfish crypt)
    * crypt_trad - passwords are stored as des crypt hashes (2 character salt crypt)

If configuration directive password_format is not specified, then passwords are considered to be in a PLAINTEXT format.

Example mailserver configuration (file smtpd.conf):

pwcheck_method: auxprop
auxprop_plugin: sql
allowanonymouslogin: no
allowplaintext: yes
mech_list: PLAIN LOGIN
srp_mda: md5

srvtab: /dev/null
opiekeys: /dev/null

password_format: crypt

sql_user: username
sql_passwd: password
sql_hostnames: sql.example.org
sql_database: database_name
sql_select: SELECT password FROM mailbox WHERE username = '%u' AND realm = '%r'

Download

    * version 2.1.19
    * version 2.1.19, FreeBSD Ports edition

Contact

You are free to contact me on my personal email address.

ziggler

http://bbs3.chinaunix.net/archiver/tid-1195705.html

http://www.host01.com/article/se ... 1409074080879_2.htm

ruochen

如果sasl要支持crypt加密,是要打补丁的.

下面的文章共你参考
http://www.thismail.org/bbs/view ... &extra=page%3D1

iheaing

原帖由 ruochen 于 2010-1-14 18:13 发表
如果sasl要支持crypt加密,是要打补丁的.

下面的文章共你参考
http://www.thismail.org/bbs/view ... &extra=page%3D1

在安装 /usr/ports/security/cyrus-sasl2 时，我钩选了  AUTHDAEMOND，而且 authtest 测试也是正常的。

# authtest -s login iheaing@ddss.org inmmged Authentication succeeded.      Authenticated: iheaing@ddss.org  (uid 80, gid 80)     Home Directory: /usr/virtual            Maildir: ddss.org/iheaing/              Quota: 51200000 Encrypted Password: $1$86fa88b8$0rSwa7ELxbMZSudFtGlzx0 Cleartext Password: inmmged            Options: wbnodsn=1

当 /usr/local/lib/sasl2/smtpd.conf 文件内容改为下面这样也不行：

1. pwcheck_method: authdaemond
   
2. authdaemond_path: /var/run/authdaemond/socket
   
3. log_level: 3
   
4. mech_list: PLAIN LOGIN
   
5. auxprop_plugin: sql
   
6. sql_engine: pgsql
   
7. sql_hostnames: 192.168.1.2
   
8. sql_user: mail
   
9. sql_passwd: mailer
   
10. sql_database: pmail
    
11. sql_select: SELECT password FROM mailbox WHERE username = '%u@%r' AND active = true

复制代码

/var/log/maillog 文件提示：

1. postfix/smtpd[1775]: connect from unknown[192.168.1.151]
   
2. postfix/smtpd[1775]: warning: SASL authentication failure: could not verify password
   
3. postfix/smtpd[1775]: warning: unknown[192.168.1.151]: SASL login authentication failed: generic failure
   
4. postfix/smtpd[1775]: lost connection after AUTH from unknown[192.168.1.151]
   
5. postfix/smtpd[1775]: disconnect from unknown[192.168.1.151]

复制代码

[ 本帖最后由 iheaing 于 2010-1-15 08:34 编辑 ]

zlj2208

把 courier-authlib 的日志打开 文件名为：authdeamonrc，具体位置，根据你安装方式，自己查找以下，看看 DEBUG_LOGIN 的值是多少，改成 DEBUG_LOGIN=2 试试。

看看日志里面有没有更详细的日志。

/usr/local/lib/sasl2/smtpd.conf
改成

pwcheck_method: authdaemond log_level: 3 mech_list: PLAIN LOGIN authdaemond_path: /your/install/authdaemon/socket

修改 authlib 的配置文件 authmysqlrc 文件按照这个格式写，根据你的事件情况，实际配置吧

MYSQL_SERVER localhost MYSQL_DATABASE postfix MYSQL_USERNAME postfix MYSQL_PASSWORD passwd MYSQL_USER_TABLE mailbox MYSQL_LOGIN_FIELD username MYSQL_CRYPT_PWFIELD password MYSQL_UID_FIELD '1000' MYSQL_GID_FIELD '1000' MYSQL_HOME_FIELD '/var/mailbox/' MYSQL_MAILDIR_FIELD CONCAT('/var/mailbox/',maildir) MYSQL_NAME_FIELD name MYSQL_QUOTA_FIELD concat(quota,'S') MYSQL_WHERE_CLAUSE active='1'

[ 本帖最后由 zlj2208 于 2010-1-15 19:30 编辑 ]

iheaing

原帖由 scyzxp 于 2010-1-15 12:28 发表
Cyrus-SASL 2.1.x patches

NOTE from pieps: This page is mirrored from http://frost.ath.cx/software/cyrus-sasl-patches, AND is the property of the author.
His site was down occasionally, so I'v ...

似乎是正解，但我的是 cyrus-sasl-2.1.23，
cyrus-sasl-2.1.19-checkpw.c.patch可以用吗？

我在忙其它，试过的同志说一声。

scyzxp

可以的。他是2.1.x的。没有问题。我都 在用

ruochen

原帖由 scyzxp 于 2010-1-15 15:19 发表
可以的。他是2.1.x的。没有问题。我都 在用

嗯
应该是没问题的

iheaing

多谢浅尝孤独同志！第六楼的回答为最佳答案，有意见的站出来。

这个补丁在 2.1.19 就有了，为什么还不集成到 2.1.23 版本呢？

[ 本帖最后由 iheaing 于 2010-1-15 18:46 编辑 ]