[tpop3d-discuss] New feature thought / part of TODO / auth_perl_user hook?

[Dave Baker]

I've been thinking about the apop_only flag (I currently use it) and
wondering if a generic auth_perl_user hook might be able to replace it, at
least for those installs where perl authentication takes place.

Instead of having a blanket deny/disconnect on receiving the USER command
I want it to be passed off to a perl subroutine for it's own testing to
determine what to do.

Taking an extension of that, I think there could be some generalized
interface to say, "This guy just gave me a USER command, do you want me
to let him continue or not, based on the info I have already?".  Having a
scan at the other authentication schemes this would make sense for at
least perl, mysql and other.
   
In addition to the mention in the TODO (Offer an option to disconnect
users who fail to issue STLS before USER), this would let tpop3d:
1) Allow USER/PASS on some domains, but APOP only on others 
2) Allow USER/PASS based on source IP (inside/outside a firewall perhaps)
3) ...  


I've had a brief scan through the code, and see where this hook could be
attached - is anyone else working on a patch to support something like
this?  Anyone interested in helping test if I get something working?
(that's a big "if", though!!)


Dave

-- 

-    Dave Baker      :      dave@dsb3.com      :      http://dsb3.com/    -
GnuPG:  1024D/D7BCA55D / 09CD D148 57DE 711E 6708  B772 0DD4 51D5 D7BC A55D