ZhangHuangbin wrote:I'm afraid that you did it wrong.
Im afraid u got no clue what u talking about. Dont take found bugs in ur software so personally.
ZhangHuangbin wrote:*) First of all, plain password is dangerous.
"can be dangerous" - right. On the other hand. if the databases is compromised, the password is the smallest problem, since an attacker would have direct access to the mails itself.
the communication between server n client is not compromised.
ZhangHuangbin wrote:*) I don't know how your mail server was setup, but it's unbelievable a mail server doesn't support password hashes like MD5.
Just read. i wrote it. Btw: MD5 ist pretty weak, so i wouldnt act like saying its the ultimate protection. a simple bruteforce against md5 ist pretty promising attempt to get the plain password back. yes, even salted ones.
anyhow, since this is ONLY affecting the stored password IN the users table of the database and NOT the communication between server n client this is not a problem so far.
Im not using a "iRedMail server". As written before im using ur "dbmailadmin" together with dbmail/postfix. Thats why ur wiki page is pretty pointless. Sorry. (btw: as forseen: i already knew that article and it has NOTHING usefull for dbmail/postfix/auth setup)
ZhangHuangbin wrote:Currently, only MySQL backend is available. it uses Cyrus-SASL as SASL authentication server, and it supports MD5 hashes.
Well as said im not using iRedmailServer, AND as said im not interested in setting a dedicated authentication server up. If i want such i would use IPA which includes kerberos and ldap and would serve far more than ONE authentication attempt for smtp-auth.
Anyhow, its not wanted. The solution must work with dbmail/mysql/postfix ALONE. and it does.
Again: Fix the bug i mentioned (i did already provide a fix) and please consider adding a working setting-value in settings.ini allowing to choose which encryption type to use for dbmail users in the backend. btw: a feature which is provided by the really old dbmailadministrator for more than a decade now. just think about it.
i really like your piece of software so far and its a good start. that i did install apache2 ONLY for ur dbmailadmin proves that i like ur softwate so far. i hope it does develop. maybe some time to a language which is not bound to apache in the first place.
For me the thread is closed. im gonne unsubscribe it for now.
bb