Author Topic: How to change postfix and postfixadmin password in one action  (Read 3768 times)

Offline blackout69

  • Newbie
  • *
  • Posts: 1
Hello everybody,
i am using password plugin to change postfix passwords inside roundcube by editing config.inc.php file

$config['password_db_dsn'] = 'mysql://postfixuser:postfixpassword@localhost/postfix';
$config['password_query'] = 'UPDATE users SET password=ENCRYPT(%P, CONCAT(\'$6$\', SUBSTRING(SHA(RAND()), -16))) WHERE email=%u LIMIT 1';

and it works perfectly.
But I would also like to change the postfixadmin password

$config['password_db_dsn'] = 'mysql://postfixadminuser:postfixadminpassword@localhost/postfixadmin';
$config['password_query'] = 'UPDATE mailbox SET password=ENCRYPT(%P, CONCAT(\'$1$\', SUBSTRING(SHA(RAND()), -16))) WHERE username=%u LIMIT 1';

I don't understand how to make the second query run for postfixadmin as well.
Note that the two postfix and postfixadmin accounts are also different.

Could someone recommend me a solution?
Thank you in advance...

blackout69
« Last Edit: April 23, 2021, 02:04:14 PM by blackout69 »

Offline VA1DER

  • Newbie
  • *
  • Posts: 6
Re: How to change postfix and postfixadmin password in one action
« Reply #1 on: May 10, 2021, 12:11:18 PM »
Just to be clear, you are wanting the password change plugin in Roundcube to be able to change administrative poastfixadmin passwords?

This is pretty difficult to do, because not only are they in different tables, but different databases.  I can see one of two ways to do this.  Neither of them are really clean.
1) Actually patch the code in the server plugin.  Create "password_query1" and "password_query2" with the associated "password_db_dsn1" and "password_db_dsn2" and make the plugin execute both.

2) Create a trigger in MYSQL to do this.  However even triggers can't work on a different database, so you'll prolly also have to use the FEDERATED storage engine.  It will allow you to make a proxy of the postfixadmin mailbox table within the postfix database.  Then a trigger can operate on it, which will push the update to postfixadmin.

Of the two, #1 is probably less technically challenging, but #2 is prolly the more "correct" answer.  And by that I mean, it's less invasive and better (for future updates etc) not to have custom plugin code.  But neither are clean answers.

Can anyone see a simpler way I'm missing?

BTW, I hate it when people tell me I shouldn't be doing what I'm asking for help with rather than answering the question I asked.  So I tried to answer your actual question.  But I really don't think what you are asking is advisable.  Reusing a mail user password for a mail system admin tool is a bad idea™ both practically and philosophically.  On the philosophical side, they should be kept separate.  The launch codes for nuclear weapons are not the same as the the password to log into an early warning radar system.  On a practical side, the set of roundcube users and the set of postfixadmin administrators are two different sets and trying to balance updates can lead to issues.

There is no actual requirement for a postfixadmin username to be a valid email address, btw.