[tpop3d-discuss] APOP from flat files

Paul Makepeace Paul.Makepeace at realprogrammers.com
Thu, 6 Feb 2003 03:50:30 +0000


On Tue, Feb 04, 2003 at 11:49:42PM +0000, Chris Lightfoot wrote:
> On Tue, Feb 04, 2003 at 11:41:19PM +0000, Paul Makepeace wrote:
> > On Tue, Feb 04, 2003 at 08:45:49PM +0000, Chris Lightfoot wrote:
> > > On Tue, Feb 04, 2003 at 08:29:17PM +0000, Paul Makepeace wrote:
> > > > Perhaps I'm being dense, but is this possible? Are people only using
> > > > APOP with MySQL/perl/other?
> > 
> > Still wondering here - what are the data sources available for those
> > wanting APOP?
> 
> No, you're correct: there's no support in any of the other
> authenticators. There's an example auth-other script in
> scripts/ to allow individual UNIX users to authenticate
> against a password ~/.mailauth or similar.

After I sent you those patches I realised the system I'm doing this all
for uses /etc/passwd to verify the user exists & divine their uid/gid,
and then consults some other database (G?DBM as explained) for the
passwords. This is qpopper's behaviour.

I have (locally) added an APOP option to auth-passwd (which on first
blush sounds a bit twisted...). and created an auth-passwd-passwd-file
directive (which sounds even more twisted) to point it at the plaintext
password database.

Now, it's clear that auth-dbm wouldn't fully fit in this newly hybrid
sytem. There are two issues going on here: where the users come from and
where their passwords come from. You could conceivably have your user
database in /etc/passwd (e.g. shell users, and mail delivered in their
uid/gid) with the APOP passwords in a DBM file. Or a text file. Or in
PostgreSQL. Or..

So first obvious thing that occurs to me an APOP database directive that
is possibly prefixed with something like exim's dbm; syntax.

Thoughts?

Paul



-- 
Paul Makepeace ....................................... http://paulm.com/

"If my dog has no nose, then I would hug ya."
   -- http://paulm.com/toys/surrealism/