New Dovecot passwd/userdb driver for password plugin

[corford]

Hello All

I have written a driver for the Roundcube password plugin that allows users to change their mailbox password on systems that store passwords in Dovecot passwd/userdb files (see "http://wiki.dovecot.org/AuthDatabase/PasswdFile"). I wrote it for our installation and thought I would contribute it back (although it is only likely to be of interest for small Roundcube deployments).

The code is hosted here: "http://code.google.com/p/dovecotpfd/" (tar archive here: http://dovecotpfd.googlecode.com/files/dovecotpfd-1.0.tar.gz)

To use it, you will need to:

1). Place dovecotpfd.php in roundcube/plugins/password/drivers/

2). Edit roundcube/plugins/password/config.inc.php and add the following configuration directives to the bottom of the file:

Code Select Expand

// Dovecot Password File Driver options
// -----------------------------------------
// Specify the username format used in the passwd/userdb file (valid values are "%n" or "%u", corresponding to Dovecots %n and %u variables - see: http://wiki.dovecot.org/Variables)
$rcmail_config['password_dovecotpfd_format'] = "%n";
// Desired password hashing scheme (run dovecotpw -l for a list of supported schemes on your system)
$rcmail_config['password_dovecotpfd_scheme'] = "SSHA256";
3). Place chgdovecotpw in /usr/sbin

4). Create a new linux user account:

Code Select Expand

# useradd -g nogroup -s /bin/false -d /dev/null mailpasswd
5). Place dovecotpfd-setuid.c in roundcube/plugins/password/drivers/, open it in your favourite text editor and change the UID definition to match the uid of the account created in step 4 above.

6). Compile dovecotpfd-setuid.c and set the sticky bit:

Code Select Expand

# cd roundcube/plugins/password/drivers/
# gcc -o dovecotpfd-setuid dovecotpfd-setuid.c
# chown root:www-data dovecotpfd-setuid
# strip dovecotpfd-setuid
# chmod 4750 dovecotpfd-setuid
7). Make sure the mailpasswd user, created in step 4 above, has access to and write permission on the Dovecot passwd/userdb file (the location of which is set in dovecotpfd.php). The mailpasswd user also needs to be able to execute chgdovecotpw.


To activate the plugin, edit roundcube/plugins/password/config.inc.php and set $rcmail_config['password_driver'] to 'dovecotpfd'

[Marked]

Hi and thanks for posting this.

In step 7, it says ... Dovecot passwd/userdb file (the location of which is set in dovecotpfd.php)  - which shows "$passwdfile = sprintf("/home/mail/%s/passwd", $domain);"

My /home directory only contains the users' directories - each having its own "Maildir/", but no "mail" directory or passwd file anywhere.

Any clues would be greatly appreciated.

Cheers,
Mark.

[schuetzi]

Hi

I installed this plugin. Many thanks for this great work.
When I tested it, the password was sed, but no linfeed (\n) was on the end of the line, so the next user was in the same line.
I changed line number 138 in chgdovecotpw and :

138                                                 $data[1] = $new_password_hash . "\n";

Now it works.
I speak PHP as bad as english, so I hope this is o.k.

Regards,

Klaus

[corford]

Hi and thanks for posting this.

In step 7, it says ... Dovecot passwd/userdb file (the location of which is set in dovecotpfd.php)  - which shows "$passwdfile = sprintf("/home/mail/%s/passwd", $domain);"

My /home directory only contains the users' directories - each having its own "Maildir/", but no "mail" directory or passwd file anywhere.

Any clues would be greatly appreciated.

Cheers,
Mark.

Hi Mark

The $passwdfile variable needs to point to wherever you store your Dovecot userdb/passwd file. So, wherever you happen to store this file on your system, the path to it needs to be set as $passwdfile in the dovecotpfd.php file. This assumes you use Dovecot as your SASL provider and a Dovecot passwd file as the backend authentication store (otherwise my password plugin is useless to you).

The example of "$passwdfile = sprintf("/home/mail/%s/passwd", $domain);" is there to show how it is possible to use multiple passwd files, one for each domain. If you only use one passwd file for all your users, you can of course get rid of the sprintf part and replace it with a single string containing the path to the passwd file.

Hope that helps.

[corford]

Hi

I installed this plugin. Many thanks for this great work.
When I tested it, the password was sed, but no linfeed (\n) was on the end of the line, so the next user was in the same line.
I changed line number 138 in chgdovecotpw and :

138                                                 $data[1] = $new_password_hash . "\n";

Now it works.
I speak PHP as bad as english, so I hope this is o.k.

Regards,

Klaus

Hi Klaus

I think you may have hit a bug to do with the way the script outputted the passwd file once it had processed it. I have since reworked this part of the code and would suggest you try the latest version, which you can download from here: http://dovecotpfd.googlecode.com/files/dovecotpfd-1.1.tar.gz

Please let me know if that solved the problem.

Thanks,
Charlie

[toms130]

Hi everyone,

I have a problem with this plugin :
The plugin is diaplayed in roundcube, it seems that it can read my password file, but can't update
(if i put a wrong password, he says to me)

When I put correct password ans new password, it displays a message who says that it is impossible to save the new password

I found the following message in /var/log/roundcube/errors

Code Select Expand


[22-Feb-2013 17:47:07 +0100]: PHP Error: Password plugin: Broken driver dovecotpfd in /var/www/plugins/password/password.php on line 258 (POST /?_task=settings&_action=plugin.password-save?_task=&_action=)


ps : when I'm logged with the user i've created (mailpasswd) and when i use the following command, it works and updates my password file

Code Select Expand


/usr/sbin/chgdovecotpw -f=/etc/postfix/dovecot/users.conf [email protected] -s=CRAM-MD5 -p=passwd



Any ideas ?
Thanks
Thomas

[ABerglund]

Could be a simple permissions issue. Is the password file writable by the webserver user?

[alec]

Code Select Expand


[22-Feb-2013 17:47:07 +0100]: PHP Error: Password plugin: Broken driver dovecotpfd in /var/www/plugins/password/password.php on line 258 (POST /?_task=settings&_action=plugin.password-save?_task=&_action=)


This error just means that the driver is incompatible with password plugin version you're using. If you know PHP a little, see other drivers to see how the structure of the driver file should look like.

[toms130]

Turns out that there was some things to change in code effectively.
for people who has the same mistakes :

1st - I have add the name of the class in dovecotpfd.php

Code Select Expand


class rcube_dovecotpfd_password
{
..
}


2nd - In config.inc.php, i have change the last line by removing &quot symbols

Code Select Expand


// Specify the username format used in the passwd/userdb file (valid values are "%n" or "%u", corresponding to Dovecots %n and %u variables - see: http://wiki.dovecot.org/Variables)
$rcmail_config['password_dovecotpfd_format'] = ""%u&quot";
// Desired password hashing scheme (run dovecotpw -l for a list of supported schemes on your system)
$rcmail_config['password_dovecotpfd_scheme'] = "CRAM-MD5";



Thomas

[bguardian]

toms130 in on the right path, to get the dovecotpfd-plugin working with roundcube 0.8.6 (0.8.x?) actually this is needed:

edit  dovecotpfd.php:

Code Select Expand


class rcube_dovecotpfd_password
{
   function save($currpass, $newpass)
   {

... (the old code without the first function-declaration changed above!) ...

}


there is no need to change "config.inc.php", the old line is still working:

Code Select Expand

$rcmail_config['password_dovecotpfd_format'] = ""%u&quot";

[Auguss]

This might a along the same lines of this thread. I am using a web host service provider as in ipage.com or godaddy.com. How do i alter this plugin to change password on their servers using this plugin.

I know all the server information, as in address and ports, just need to know where to put the information for this to happen, if it can.

[onlyindian]

Guys 

This is my error log. Please can you tell me what am I suppose to do.  I know i am very late, as this post is quite old, still with some hope that i am posting here my error log.


[09-Feb-2014 20:33:39 +0530]: PHP Error: Password plugin: /usr/html/roundcube/plugins/password/drivers/dovecotpfd-setuid returned an error in /usr/html/roundcube/plugins/password/drivers/dovecotpfd.php on line 81 (POST /?_task=settings&_action=plugin.password-save?_task=&_action=)

[Porrier]

Hi!

I seems I posted my first request to the wrong place.

I managed to install the dovecotpfd-1.1 plugin. It is working so far. I used to use special chars in my password like ? or !. I found out that these chars are escaped when the new password is written. I used:

/usr/sbin/chgdovecotpw -f=/usr/etc/dovecot/passwd [email protected] -s=PLAIN -p=my?01

and the password is written as my\?01. The login then does not work ofcourse. I suppose this is the reason why I cannot login when I created a new password with -s=CRAM-MD5 too.

is this module still maintained and is there a solution for this Problem?

Greetings

  Andreas