a23d4b3da9
Exclude some tests with dependencies. Remove -T from perl line in plugins This makes it harder to test with PERL5LIB/perlbrew etc
146 lines
4.5 KiB
Perl
146 lines
4.5 KiB
Perl
#!perl -w
|
|
|
|
=head1 NAME
|
|
|
|
auth_vpopmail_sql - Authenticate to vpopmail via MySQL
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
This plugin authenticates vpopmail users directly against a standard
|
|
vpopmail MySQL database. It makes the not-unreasonable assumption that
|
|
both pw_name and pw_domain are lowercase only (qmail doesn't actually care).
|
|
If you are using CRAM-MD5, it also requires that vpopmail be built with the
|
|
recommended '--enable-clear-passwd=y' option, because there is no way
|
|
to compare the crypted password.
|
|
|
|
=head1 CONFIGURATION
|
|
|
|
echo "dbi:mysql:dbname=vpopmail;host=127.0.0.1" > config/vpopmail_mysql_dsn
|
|
echo "vpopmailuser" > config/vpopmail_mysql_user
|
|
echo "vpoppasswd" > config/vpopmail_mysql_pass
|
|
|
|
This can be a read-only database user since the plugin does not update the
|
|
last accessed time (yet, see below).
|
|
|
|
This module supports PLAIN, LOGIN, and CRAM-MD5 authentication methods. You
|
|
can disable undesired methods by editing this module and uncommenting
|
|
the lines in the register() sub. See the POD for Qspmtpd::Auth for more
|
|
details on the ramifications of supporting various authentication methods.
|
|
|
|
The remote user must login with a fully qualified e-mail address (i.e. both
|
|
account name and domain), even if they don't normally need to. This is
|
|
because the vpopmail table has a unique index on pw_name/pw_domain, and this
|
|
module requires that only a single record be returned from the database.
|
|
|
|
=head1 LIMITATIONS
|
|
|
|
This authentication modules does not recognize domain aliases. So, if you have
|
|
the domain example.com, with domain aliases for example.org and example.net,
|
|
smtp-auth will only work for $user@example.com. If you have domain aliases,
|
|
consider using another plugin (see SEE ALSO).
|
|
|
|
=head1 FUTURE DIRECTION
|
|
|
|
The default MySQL configuration for vpopmail includes a table to log access,
|
|
lastauth, which could conceivably be updated upon sucessful authentication.
|
|
The addition of this feature is left as an exercise for someone who cares. ;)
|
|
|
|
=head1 SEE ALSO
|
|
|
|
For an overview of the vpopmail authentication plugins and their merits,
|
|
please read the VPOPMAIL section in docs/authentication.pod
|
|
|
|
=head1 AUTHOR
|
|
|
|
John Peacock <jpeacock@cpan.org>
|
|
|
|
=head1 COPYRIGHT AND LICENSE
|
|
|
|
Copyright (c) 2004 John Peacock
|
|
|
|
This plugin is licensed under the same terms as the qpsmtpd package itself.
|
|
Please see the LICENSE file included with qpsmtpd for details.
|
|
|
|
=cut
|
|
|
|
sub register {
|
|
my ( $self, $qp ) = @_;
|
|
|
|
$self->register_hook("auth-plain", "auth_vmysql" );
|
|
$self->register_hook("auth-login", "auth_vmysql" );
|
|
$self->register_hook("auth-cram-md5", "auth_vmysql");
|
|
}
|
|
|
|
sub auth_vmysql {
|
|
my ( $self, $transaction, $method, $user, $passClear, $passHash, $ticket ) = @_;
|
|
|
|
use DBI;
|
|
use Qpsmtpd::Constants;
|
|
use Digest::HMAC_MD5 qw(hmac_md5_hex);
|
|
|
|
# $DB::single = 1;
|
|
|
|
my $dsn = $self->qp->config("vpopmail_mysql_dsn") || "dbi:mysql:dbname=vpopmail;host=127.0.0.1";
|
|
my $dbuser = $self->qp->config("vpopmail_mysql_user") || "vpopmailuser";
|
|
my $dbpass = $self->qp->config("vpopmail_mysql_pass") || "vpoppasswd";
|
|
|
|
my $dbh = DBI->connect( $dsn, $dbuser, $dbpass );
|
|
$dbh->{ShowErrorStatement} = 1;
|
|
|
|
my ( $pw_name, $pw_domain ) = split '@', lc($user);
|
|
|
|
return DECLINED if ! defined $pw_domain;
|
|
|
|
$self->log(LOGINFO,
|
|
"Authentication to vpopmail via mysql: $pw_name\@$pw_domain");
|
|
|
|
my $sth = $dbh->prepare(<<SQL);
|
|
SELECT *
|
|
FROM vpopmail
|
|
WHERE pw_name = ? AND pw_domain = ?
|
|
SQL
|
|
|
|
$sth->execute( $pw_name, $pw_domain );
|
|
|
|
my $passwd_hash = $sth->fetchrow_hashref;
|
|
|
|
$sth->finish;
|
|
$dbh->disconnect;
|
|
|
|
# if vpopmail was not built with '--enable-clear-passwd=y'
|
|
# then pw_clear_passwd may not even exist
|
|
my $pw_clear_passwd = exists $passwd_hash->{'pw_clear_passwd'}
|
|
? $passwd_hash->{'pw_clear_passwd'}
|
|
: undef;
|
|
my $pw_passwd = $passwd_hash->{'pw_passwd'}; # this is always present
|
|
|
|
if ( # clear_passwd isn't defined so we cannot support CRAM-MD5
|
|
( $method =~ /CRAM-MD5/i and not defined $pw_clear_passwd )
|
|
or
|
|
# user doesn't exist in this domain
|
|
( not defined $pw_passwd )
|
|
) {
|
|
return ( DECLINED, "auth_vmysql/$method" );
|
|
}
|
|
|
|
# at this point we can assume the user name matched
|
|
if (
|
|
( defined $passClear and
|
|
(
|
|
($pw_clear_passwd eq $passClear)
|
|
or ($pw_passwd eq crypt( $passClear, $pw_passwd ) )
|
|
)
|
|
)
|
|
or ( defined $passHash
|
|
and $passHash eq hmac_md5_hex( $ticket, $pw_clear_passwd ) )
|
|
)
|
|
{
|
|
|
|
return ( OK, "auth_vmysql/$method" );
|
|
}
|
|
else {
|
|
return ( DENY, "auth_vmysql/$method - wrong password" );
|
|
}
|
|
}
|
|
|