IMAP/POP3 authentication: what strong password hashing mechanism for a mysql backend?
Jump to:
Description
I am setting up a postscript/courier server. I am using a database backend to store users.
/etc/postfix/main.cf has:
virtual_mailbox_maps = mysql:/etc/postfix/mysql_mailbox.cf
virtual_alias_maps = mysql:/etc/postfix/mysql_alias.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql_domains.cf
/etc/courier/authdaemonrc has:
authmodulelist="authmysql"
For both postscript and courier, the mysql configuration files are properly set with the DB name, table, DB user and DB password. Both daemons can connect to the mysql server and check for users in the database.
Users in the database were added using the mysql encrypt()
command like this:
INSERT INTO users (id,name,maildir,crypt) VALUES
('user@example.org','user','user/',encrypt('password'));
A debugging session with telnet showed that only the first 8 characters are taken into account. The password can be longer, but then it does not matter.
Comments
#1
http://dev.mysql.com/doc/refman/5.5/en/encryption-functions.html#functio...
That already explains a lot.
Now, do I need to use encrypt() or is there a better solution?
#2
I asked here:
http://ubuntuforums.org/showthread.php?t=2090730