a6e664ce83
removed auth method from return calls in all auth plugins. The caller knows the mechanism already. In the code, the difference looks like this:
before:
or return (DENY, "authcvm/$method");
after:
or return (DENY, "authcvm");
Added debug level log entries in auth_vpopmaild
Conflicts:
plugins/auth/auth_vpopmail_sql
121 lines
3.3 KiB
Perl
121 lines
3.3 KiB
Perl
#!perl -w
|
|
|
|
=head1 NAME
|
|
|
|
auth_vpopmail - Authenticate against libvpopmail.a
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
This plugin authenticates vpopmail users using p5-vpopmail.
|
|
Using CRAM-MD5 requires that vpopmail be built with the
|
|
'--enable-clear-passwd=y' option.
|
|
|
|
=head1 CONFIGURATION
|
|
|
|
This module will only work if qpsmtpd is running as the 'vpopmail' user.
|
|
|
|
CRAM-MD5 authentication will only work with p5-vpopmail 0.09 or higher.
|
|
http://github.com/sscanlon/vpopmail
|
|
|
|
Decide which authentication methods you are willing to support and uncomment
|
|
the lines in the register() sub. See the POD for Qspmtpd::Auth for more
|
|
details on the ramifications of supporting various authentication methods.
|
|
|
|
=head1 SEE ALSO
|
|
|
|
For an overview of the vpopmail authentication plugins and their merits,
|
|
please read the VPOPMAIL section in docs/authentication.pod
|
|
|
|
=head1 AUTHOR
|
|
|
|
Matt Simerson <msimerson@cpan.org>
|
|
|
|
=head1 COPYRIGHT AND LICENSE
|
|
|
|
Copyright (c) 2010 Matt Simerson
|
|
|
|
This plugin is licensed under the same terms as the qpsmtpd package itself.
|
|
Please see the LICENSE file included with qpsmtpd for details.
|
|
|
|
=cut
|
|
|
|
use strict;
|
|
use warnings;
|
|
|
|
use Qpsmtpd::Constants;
|
|
|
|
use Digest::HMAC_MD5 qw(hmac_md5_hex);
|
|
use vpopmail;
|
|
|
|
sub register {
|
|
my ($self, $qp) = @_;
|
|
|
|
$self->register_hook("auth-plain", "auth_vpopmail" );
|
|
$self->register_hook("auth-login", "auth_vpopmail" );
|
|
$self->register_hook("auth-cram-md5", "auth_vpopmail");
|
|
}
|
|
|
|
sub auth_vpopmail {
|
|
my ($self, $transaction, $method, $user, $passClear, $passHash, $ticket) =
|
|
@_;
|
|
my ($pw_name, $pw_domain) = split "@", lc($user);
|
|
|
|
$self->log(LOGINFO, "Authenticating against vpopmail: $user");
|
|
|
|
return (DECLINED, "auth_vpopmail - plugin not configured correctly")
|
|
if !test_vpopmail();
|
|
|
|
my $pw = vauth_getpw($pw_name, $pw_domain);
|
|
my $pw_clear_passwd = $pw->{pw_clear_passwd};
|
|
my $pw_passwd = $pw->{pw_passwd};
|
|
|
|
# make sure the user exists
|
|
if (!$pw || (!$pw_clear_passwd && !$pw_passwd)) {
|
|
return (DENY, "auth_vpopmail - invalid user");
|
|
|
|
# change DENY to DECLINED to support multiple auth plugins
|
|
}
|
|
|
|
return (OK, "auth_vpopmail")
|
|
if $pw_passwd eq crypt($passClear, $pw_passwd);
|
|
|
|
# simplest case: clear text passwords
|
|
if (defined $passClear && defined $pw_clear_passwd) {
|
|
return (DENY, "auth_vpopmail - incorrect password")
|
|
if $passClear ne $pw_clear_passwd;
|
|
return (OK, "auth_vpopmail");
|
|
}
|
|
|
|
if ($method =~ /CRAM-MD5/i) {
|
|
|
|
# clear_passwd isn't defined so we cannot support CRAM-MD5
|
|
return (DECLINED, "auth_vpopmail") if !defined $pw_clear_passwd;
|
|
|
|
if (defined $passHash
|
|
and $passHash eq hmac_md5_hex($ticket, $pw_clear_passwd))
|
|
{
|
|
}
|
|
}
|
|
|
|
return (OK, "auth_vpopmail")
|
|
if (defined $passHash
|
|
&& $passHash eq hmac_md5_hex($ticket, $pw_clear_passwd));
|
|
|
|
return (DENY, "auth_vpopmail - unknown error");
|
|
}
|
|
|
|
sub test_vpopmail {
|
|
|
|
# vpopmail will not allow vauth_getpw to succeed unless the requesting user is vpopmail or root.
|
|
# by default, qpsmtpd runs as the user 'qpsmtpd' and does not have permission.
|
|
eval "use vpopmail";
|
|
if ( $@ ) {
|
|
warn "vpopmail perl module not installed.\n";
|
|
return;
|
|
};
|
|
my ($domain) = vpopmail::vlistdomains();
|
|
my $r = vauth_getpw('postmaster', $domain);
|
|
return if !$r;
|
|
return 1;
|
|
}
|