Re: [Dovecot] checkpassword protocol

2013-04-08 Thread Heiko Schlichting
Hmm. The AUTH_PASSWORD wasn't really an intentional addition .. but I guess it can stay there. Some 10 years ago that might not have been such a good idea since there were still some systems where process environment variables were readable to all users in the system, but I doubt there exist

Re: [Dovecot] checkpassword protocol

2013-04-08 Thread Timo Sirainen
On 8.4.2013, at 10.00, Heiko Schlichting doveco...@fu-berlin.de wrote: Hmm. The AUTH_PASSWORD wasn't really an intentional addition .. but I guess it can stay there. Some 10 years ago that might not have been such a good idea since there were still some systems where process environment

Re: [Dovecot] checkpassword protocol

2013-04-08 Thread Heiko Schlichting
Timo wrote: All the OSes made the environment private 10-15 years ago. I think it's pretty safe to assume that older multiuser systems won't be running Dovecot with checkpassword backend. The checkpassword interface is used in many different ways: I found checkpassword the easiest way to

Re: [Dovecot] checkpassword protocol

2013-04-08 Thread Timo Sirainen
On 8.4.2013, at 13.42, Heiko Schlichting doveco...@fu-berlin.de wrote: The checkpassword interface is used in many different ways: I found checkpassword the easiest way to implement authentication against FreeRADIUS. Using a perl script with $input = IO::Handle-new_from_fd(3, r);

[Dovecot] checkpassword protocol

2013-04-07 Thread dovecot . pkoch
Hi, I'm writing a checkpassword script in order to support our OTP token as a fallback for client certificate authentication. Here are two questions: 1) It seems to me that the username and the password will be delivered to my script both on file descriptor 3 and via the environment variables

Re: [Dovecot] checkpassword protocol

2013-04-07 Thread Timo Sirainen
On 7.4.2013, at 14.30, dovecot.pk...@dfgh.net wrote: I'm writing a checkpassword script in order to support our OTP token as a fallback for client certificate authentication. Here are two questions: 1) It seems to me that the username and the password will be delivered to my script both on