2

I have a database that has a username, password, and password salt in it. The password is hashed using SHA512.

The data in my users database looks like this:

user = testuser

password_hash = 4acf9dc364843d1adfadfadf42de7d5707b791cc3ee8a2013f15efa8bdb

password_salt = QYhZ47zsQA=

I'm trying to authenticate to this database using dovecot sql authentication and SSHA512. I've turned authentication debugs on and I see this in mail.log:

dovecot: auth-worker(8603): Debug: sql(testuser,22.22.22.22): query: SELECT username as user, password_hash as password, password_salt as salt FROM users WHERE username='testuser';
dovecot: auth-worker(8603): sql(testuser,22.22.22.22): Password mismatch
dovecot: auth-worker(8603): Debug: sql(testuser,22.22.22.22): SSHA512(testpassword) != '4acf9dc364843d1adfadfadf42de7d5707b791cc3ee8a2013f15efa8bdb'
dovecot: auth: Debug: client passdb out: FAIL#0111#011user=testuser#011salt=QYhZ47zsQA=
dovecot: auth: Debug: client in:   AUTH#0112#011PLAIN#011service=imap#011secured#011session=rZmPoRYOagBJ3Ukh#011lip=33.33.33.33#01    1rip=22.22.22.22#011lport=993#011rport=53098#011resp=AHJpY2hlZQBjY2NwdGFtdDNtcA== (previous base64 data may contain sensitive data)
dovecot: imap-login: Disconnected (auth failed, 2 attempts in 8 secs): user=<testuser>, method=PLAIN, rip=22.22.22.22, lip=33.33.33.33, TLS, session=<rZmPoRYOagBJ3Ukh>

I've also tried to do an auth test which fails too:

$ sudo doveadm auth test testuser testpassword
passdb: richee auth failed
extra fields:
  user=testuser
  salt=QYhZ47zsQA=

Unfortunately the dovecot documentation doesn't cover exactly how to authenticate against salted hashes. I feel like I need to tell dovecot that my password hash is hex Salted SHA512 and my salt is 8 bytes base64. However I have no idea how to tell dovecot to use the salt. How can I use salts when authenticating dovecot?

Improve this question

1 Answer 1

Reset to default
2

For SQL-lookup password, dovecot has additional documentation in here. For additional info you can read a thread on SO: How to securely generate SSHA256 or SSHA512 hashes in PHP?. In this answer I assume that you use MySQL for database.

In order to matching dovecot auth scheme and your custom auth scheme, one of the method is your query must be returned password field that contain

{SSHA512.HEX}HashofPasswordandSaltinHEXformatSaltinHEXformattoo

With string manipulation from SQL, we can construct a query like this

SELECT CONCAT("{SSHA512.HEX}", `hex_password`, HEX(FROM_BASE64(`salt`))) AS password FROM mytable WHERE userid = '%u'

Put above query to password_query parameter in dovecot-sql configuration file.

In the query above, we construct the special string via SQL concat. Of course because you have different format for salt and hash, then we must convert it by base-64 decoding then hex-encoding.

Looks like the discussion here has been reblogged on this page with more complete and comprehensive information.

Improve this answer
4
  • This helps a lot but it still doesn't work. I've changed both my password and salt to hex. My errors look like this: pastebin.com/g9BumKDj
    – Tom Freezers
    Feb 8, 2015 at 6:21
  • Hi @TomFreezers, thanks for clarifying the answer. From the pastebin I have: (1) your password field was 128 bytes, (2) SHA512 hash always 64 bytes, so (3) your salt has 64 bytes-length. Are these true?
    – masegaloeh
    Feb 8, 2015 at 11:58
  • Yes in this case my salt is "5db034e27bda3045ef9e6057eb4799ea9c05d35c6a3b361697b20689ce44b16d". I'm using ruby to create the password hash and that function looks like this: salt = SecureRandom.hex(32) hash = Digest::SHA512.hexdigest(password+salt) I've also confirmed that my authentication works if I use SHA512 without a salt by changing both the way the password is hashed and the way dovecot expects it to be.
    – Tom Freezers
    Feb 8, 2015 at 17:50
  • 1
    It must be the way ruby is creating the hash. I've tried this with python and it works perfect. The python script I used was gist.github.com/garrettreid/8329796
    – Tom Freezers
    Feb 8, 2015 at 18:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .