Postfix (SASL) / MySQL: Use MD5 Encryption?

Question

Is it possible to use MD5 password encryption to encrypt passwords when using Postfix / SASL and MySQL? Currently, my setup is using the MySQL CRYPT() function, which for various reasons isn't ideal.

Answer 1

yes it is possible.

I guess you are using libpam-mysql. There is an option you can set named crypt.

auth       optional     pam_mysql.so user=username passwd=password verbose=0 db=thedb table=user usercolumn=userName  passwdcolumn=userPassword crypt=3
account       required     pam_mysql.so user=username passwd=password verbose=0 db=thedb table=user usercolumn=userName  passwdcolumn=userPassword crypt=3

you can also use auth required

Then crypt yout Passwords with MD5 in mysql.

You can find the docu in the readme und /usr/share/doc/libpam-mysql

I quote a part:

crypt (plain)

The method to encrypt the user's password:

   0 (or "plain") = No encryption.  Passwords stored in plaintext.
                    HIGHLY DISCOURAGED.

   1 (or "Y")     = Use crypt(3) function.

   2 (or "mysql") = Use MySQL PASSWORD() function. It is possible
                    that the encryption function used by PAM-MySQL
                    is different from that of the MySQL server, as
                    PAM-MySQL uses the function defined in MySQL's
                    C-client API instead of using PASSWORD() SQL
                    function in the query.

   3 (or "md5")   = Use plain hex MD5

In saslauthd config file in debian you have to set,

MECHANISMS="pam"

dont know how to set it in another distribution, bur the process have to be startet like this.

/usr/sbin/saslauthd -a pam

But I guess you already have that.