1

I have recently switched my password hashing from md5 to ssha512. This works fine with dovecot, so I can read incoming mail without problems.

It does not work as well for exim4.

Log output from exim4:

less /var/log/exim4/rejectlog

2015-07-27 13:36:42 fixed_plain authenticator failed for CURRENT_LOCATION (loki) [212.71.209.15]: 435 Unable to authenticate at present ([email protected]): lookup of "select concat(users.username,'@',domains.domain_name) from users left join sites on sites.site_id=users.site_id left join domains on domains.site_id=sites.site_id where concat(users.username,'@',domains.domain_name)='[email protected]' and users.password=ssha.b64('SECRETPASSWORD')" gave DEFER: MYSQL: query failed: FUNCTION ssha.b64 does not exist

(The identifying details have been exchanged for privacy reasons)

This is obviously due to the reason that there is no ssha.b64-function in mysql. Is there any way to query mysql with the plain password so that mysql hashes and salts the password from the salt is has in its database?

Relevant config files:

cat /etc/exim4/conf.d/auth/25_exim4-dave-virtmail
fixed_plain:
  driver = plaintext
  public_name = PLAIN
  # old query, still using md5 (not working anymore)
  server_condition = ${lookup mysql{select concat(users.username,'@',domains.domain_name) from users left join sites on sites.site_id=users.site_id left join domains on domains.site_id=sites.site_id where concat(users.username,'@',domains.domain_name)='$2' and users.password=md5('$3')}{1}fail}
# obviously wrong query, test
#  server_condition = ${lookup mysql{select concat(users.username,'@',domains.domain_name) from users left join sites on sites.site_id=users.site_id left join domains on domains.site_id=sites.site_id where concat(users.username,'@',domains.domain_name)='$2' and users.password=ssha.b64('$3')}{1}fail}
  server_set_id = $2

fixed_login:
  driver = plaintext
  public_name = LOGIN
  server_prompts = "Username:: : Password::"
  # old query, still using md5 (not working anymore)
  server_condition = ${lookup mysql{select concat(users.username,'@',domains.domain_name) from users left join sites on sites.site_id=users.site_id left join domains on domains.site_id=sites.site_id where concat(users.username,'@',domains.domain_name)='$1' and users.password=md5('$2')}{1}fail}
  # obviously wrong query, test
  # server_condition = ${lookup mysql{select concat(users.username,'@',domains.domain_name) from users left join sites on sites.site_id=users.site_id left join domains on domains.site_id=sites.site_id where concat(users.username,'@',domains.domain_name)='$1' and users.password=ssha.b64('$2')}{1}fail}
  server_set_id = $1

Compare to dovecot:

cat /etc/dovecot/dovecot-sql.conf.ext|grep password_query
password_query = select users.username AS username, domains.domain_name AS domain, concat("{SSHA512.BASE64}", users.password) AS password from users left join sites on sites.site_id=users.site_id left join domains on domains.site_id=sites.site_id where concat(users.username,'@',domains.domain_name)= '%u'

I'd be grateful for pointers or a working mysql-query. I know where the bug is but I can't figure out the correct query.

1 Answer 1

1

Should have looked better into the documentation.

According to the exim documentation, exim does not support ssha512(yet?).

I took the easy way out and just told exim to use dovecot for authentication purposes, like the dovecot documentation tells you to.

I'm sorry to have wasted your time and I hope, someone will benefit from my experience.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .