5285774285
unit tests for new methods are in t/auth.t
added PLAIN and LOGIN tests in auth_flat_file
Most tests are disabled unless an interactive terminal is detected and $ENV{QPSMTPD_DEVELOPER} is set.
80 lines
2.0 KiB
Perl
80 lines
2.0 KiB
Perl
#!perl -w
|
|
|
|
=head1 NAME
|
|
|
|
auth_flat_file - simple CRAM MD5 auth plugin using a flat password file
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
in config/plugins:
|
|
|
|
auth/auth_flat_file
|
|
|
|
in config/flat_auth_pw
|
|
|
|
username1:password1
|
|
username2:password2
|
|
...
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
This plugin implements a very simple authentication plugin using a flat password
|
|
file containing username and password separated by colons.
|
|
|
|
Note that this plugin enforces the use of a full email address (including
|
|
@domain) as the username. There's no particular reason for this so feel free
|
|
to modify the code to suit your setup.
|
|
|
|
The password is stored on disk unencrypted, however authentication uses a HMAC
|
|
algorithm so no password is transfered in the clear.
|
|
|
|
=cut
|
|
|
|
use Digest::HMAC_MD5 qw(hmac_md5_hex);
|
|
|
|
sub register {
|
|
my ( $self, $qp ) = @_;
|
|
|
|
$self->register_hook('auth-plain', 'auth_flat_file');
|
|
$self->register_hook('auth-login', 'auth_flat_file');
|
|
$self->register_hook('auth-cram-md5', 'auth_flat_file');
|
|
}
|
|
|
|
sub auth_flat_file {
|
|
my ( $self, $transaction, $method, $user, $passClear, $passHash, $ticket ) =
|
|
@_;
|
|
|
|
if ( ! defined $passClear && ! defined $passHash ) {
|
|
return ( DENY, "authflat - missing password" );
|
|
}
|
|
|
|
my ( $pw_name, $pw_domain ) = split '@', lc($user);
|
|
|
|
unless ( defined $pw_domain ) {
|
|
return DECLINED;
|
|
}
|
|
|
|
my ($auth_line) = grep {/^$pw_name\@$pw_domain:/} $self->qp->config('flat_auth_pw');
|
|
|
|
if ( ! defined $auth_line) {
|
|
$self->log(LOGINFO, "User not found: $pw_name\@$pw_domain");
|
|
return DECLINED;
|
|
}
|
|
|
|
$self->log(LOGINFO, "Authentication for: $pw_name\@$pw_domain");
|
|
|
|
my ($auth_user, $auth_pass) = split(/:/, $auth_line, 2);
|
|
|
|
# at this point we can assume the user name matched
|
|
if ( defined $passClear && $auth_pass eq $passClear ) {
|
|
return ( OK, "authflat" );
|
|
};
|
|
|
|
if ( defined $passHash && $passHash eq hmac_md5_hex($ticket, $auth_pass) ) {
|
|
return ( OK, "authflat" );
|
|
};
|
|
|
|
return ( DENY, "authflat - wrong password" );
|
|
}
|
|
|