Re: Tip: update dovecot MD5 password from PAM

2017-03-28 Thread Doug Barton
This is nonsense. You made a mistake in your configuration. Before you try again next time, you should probably discuss your plan with the list to make sure you're on the right track. Good luck, Doug On 03/26/2017 03:13 PM, Ruga wrote: (I tried to protect dovecot passwords with bcrypt, but

Re: Tip: update dovecot MD5 password from PAM

2017-03-27 Thread Ruga
Right. But that's what I experienced. The next experiment is sheduled in two weeks... I will keep notes and logs for you. Sent from ProtonMail Mobile On Mon, Mar 27, 2017 at 2:21 PM, Aki Tuomi wrote: On 27.03.2017 01:13, Ruga wrote: > It is a jolly bad idea to use the same password for both em

Re: Tip: update dovecot MD5 password from PAM

2017-03-27 Thread Aki Tuomi
On 27.03.2017 01:13, Ruga wrote: > It is a jolly bad idea to use the same password for both email and system > access. > > On TLS+plaintext, if your passwords are slurped by a python script, all > accounts are compromised. Congratulations, the NSA will love you. On the > other side of the ocea

Re: Tip: update dovecot MD5 password from PAM

2017-03-26 Thread Ruga
It is a jolly bad idea to use the same password for both email and system access. On TLS+plaintext, if your passwords are slurped by a python script, all accounts are compromised. Congratulations, the NSA will love you. On the other side of the ocean, however, there are European states where yo

Re: Tip: update dovecot MD5 password from PAM

2017-03-26 Thread Alexander Dalloz
Am 26.03.2017 um 19:22 schrieb Steinar Bang: I worry less about the security of a password stored in a local file compared to the security of transferring the same password in cleartext over the wire, SSL or not. A TLS secured communication ensures that authentication credentials aren't transm

Re: Tip: update dovecot MD5 password from PAM

2017-03-26 Thread Steinar Bang
> Aki Tuomi : > Is there some reason you cannot protect your users with TLS/SSL? I do use SSL. I don't understand what that have to do with the preference of CRAM-MD5 over plain text auth? > Using CRAM-MD5 is not very secure option, since you have to store the > password in clear text. Plai

Re: Tip: update dovecot MD5 password from PAM

2017-03-26 Thread Aki Tuomi
> On March 26, 2017 at 2:24 PM Steinar Bang wrote: > > > > Aki Tuomi : > > > On 2017-03-25 17:54, Steinar Bang wrote: > >> This is a PAM module that listens for password changes, and will update > >> the MD5 password for a user, in a file that dovecot can read, when the > >> user's passwor

Re: Tip: update dovecot MD5 password from PAM

2017-03-26 Thread Steinar Bang
> Aki Tuomi : > On 2017-03-25 17:54, Steinar Bang wrote: >> This is a PAM module that listens for password changes, and will update >> the MD5 password for a user, in a file that dovecot can read, when the >> user's password is changed: >> https://github.com/steinarb/pam_dovecotmd5pwd >> >> C

Re: Tip: update dovecot MD5 password from PAM

2017-03-25 Thread Aki Tuomi
On 2017-03-25 17:54, Steinar Bang wrote: This is a PAM module that listens for password changes, and will update the MD5 password for a user, in a file that dovecot can read, when the user's password is changed: https://github.com/steinarb/pam_dovecotmd5pwd Caveat emptor! (Works for me...! :