On 15/04/08 15:23:23, D. Hilbig wrote:
It would be nice if the learn-password feature was moved into
vpopmail so
that Courier-Authlib could support the learning.
I don't really know why people are so keen on Dovecot. Is it
because it is
part of RH now? I'm sticking with Courier-IMAP because Dovecot
isn't mature
isnt mature? WTF? what rock you been living under :)
and RH? Haven't used a RH OS on a server in many years... slackware
and Solaris here.
Dovecot is preffered because it is very fast and efficient and
nowhere near the resource hog that courier is and always has been,
and I dont need 2 programs for one (pop3 and an auth (ahh make that 3
when you include imap)) that are completely separate programs but to
use pop3/imap you need the other (nor do we have to rebuild dovecot
everytime we update vpopmail), for performance increase it would be
in the vicinity of about 10 fold, of course if you have a pop/imap
server doing SFA traffic you might not notice it, but have one with
hundreds or thousands of concurrent users and you'll clearly see the
difference, if we stayed on courier, we would have at least 2 more
pop3 servers and at least one more webmail server just to handle the
load, and what we have now teh servers still sit there saying to us
"bring it on".
-----Original Message-----
From: Tom Collins [mailto:[EMAIL PROTECTED]
Sent: Monday, April 14, 2008 10:00 PM
To: vchkpw@inter7.com
Subject: Re: [vchkpw] not auto-learning passwords
On Apr 14, 2008, at 3:46 PM, D. Hilbig wrote:
> If I do a plaintext login which will check against the hashed
password
> stored in the SQL table, I can login with any password. However,
a
> CRAM-MD5
> login (which checks against the clear password) with any password
> will fail.
> If both the hashed password and clear password in the SQL table
are
> NULL
> (empty), I'd expect the behavior to be the same regardless of
CRAM-
> MD5 or
> plaintext.
IIRC, this was intentional. It's impossible to learn a password
via
CRAM-MD5, so we fail until we can learn a password through some
other
method.
Password learning happens in vchkpw, but I guess it should move
into
vpopmail so any app calling the API can have a password "learned".
And to those who recommend Dovecot, it probably doesn't do learning
either, for the same reasons.
I just checked courier 3.0.8, and it looks like it should update
the
password... I checked dovecot 1.0.10, and found this, "Thanks to
Courier-IMAP for showing how the vpopmail API should be used". It
doesn't appear to have code that updates the password.
Unfortunately, there's no way to update libvpopmail to have it
learn
the password. We'll have to update the individual apps (courier
and
dovecot) and get the maintainers to accept the changes into the
next
release.
-Tom
!DSPAM:48043e3d120509212217841!
