ok not what you probably want to hear
c, python etc uses % as a variable indicator along with the next
character using a format variable (like %s being a string variable)
this is what is causing the issue
Not saying for sure but experience wise i am not familiar with any
system allowing a % sign in the password now a days ?
could be wrong, i guess it depends on the backbone password fetcher process
even if you could get dovecot (or any c based programming) to allow for
this clients would probably have similiar issues which there would be no
real control over.
another charater would also be '\' as it is used to being a delimiter
for the next character being absolute
along with \x00 (non ascii characters in a string)
again just an experience fyi
Happy Tuesday !!!
Thanks - paul
Paul Kudla
Scom.ca Internet Services <http://www.scom.ca>
004-1009 Byron Street South
Whitby, Ontario - Canada
L1N 4S3
Toronto 416.642.7266
Main 1.866.411.7266
Fax 1.888.892.7266
Email [email protected]
On 8/1/2022 4:47 AM, Franz Beslmeisl wrote:
In order to change the password scheme I wrote a script named
updateproxy that needs the plain text password from the user.
To get that I use the line
password_query = SELECT username as user, password, \
'%w' as userdb_plain_pass FROM auth_user WHERE username='%n'
This works nicely with almost all passwords but not with this one
1234567%&/abcd
the error message being
dovecot: Failed to expand plugin setting plain_pass =
'1234567%&/abcd': Unknown variable '%&'
It seems to me that dovecot tries to do another level of variable
evaluation upon the **value** of the already evaluated variable.
So I searched for ways to escape problematic characters like %
and changed my line to
password_query = SELECT username as user, password, \
'%E{w}' as userdb_plain_pass FROM auth_user WHERE username='%n'
but this produces problems with password values containing quotes.
So how can I get a plain text password containing any ascii char
(or even better any utf-8 char) safely to my script?
Thanks for your suggestions
-------------- here the nasty details, if you want -------------
$ dovecot -n
# 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.7.2 ()
# OS: Linux 5.4.0-122-generic x86_64 Ubuntu 20.04.4 LTS
# Hostname: mx-10-2.bildung.hessen.de
auth_mechanisms = plain login
auth_username_chars =
abcdefghijklmnopqrstuvwxyz_0123456789.ABCDEFGHIJKLMNOPQRSTUVWXYZ-@
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
mail_location = maildir:~/Maildir
mail_privileged_group = mail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope
encoded-character vacation subaddress comparator-i;ascii-numeric
relational regex imap4flags copy include variables body enotify
environment mailbox date index ihave duplicate mime foreverypart
extracttext
namespace inbox {
inbox = yes
location =
mailbox Drafts {
auto = subscribe
special_use = \Drafts
}
mailbox Junk {
auto = subscribe
special_use = \Junk
}
mailbox Sent {
auto = subscribe
special_use = \Sent
}
mailbox "Sent Messages" {
special_use = \Sent
}
mailbox Trash {
auto = subscribe
special_use = \Trash
}
prefix =
}
passdb {
# the following file contains a '%w'-line
args = /etc/dovecot/db1.conf
driver = sql
}
passdb {
# the following file contains a '%w'-line
args = /etc/dovecot/db2.conf
driver = sql
}
passdb {
# the following file contains no '%w'-line (just for detail)
args = /etc/dovecot/db3.conf
driver = sql
}
plugin {
sieve = ~/.dovecot.sieve
sieve_dir = ~/sieve
sieve_max_actions = 64
sieve_max_redirects = 16
sieve_max_script_size = 10M
sieve_trace_debug = yes
sieve_user_log = ~/sievelog
sieve_vacation_dont_check_recipient = yes
sieve_vacation_use_original_recipient = yes
}
protocols = imap sieve lmtp
service auth {
unix_listener /var/spool/postfix/private/dovecot-auth {
group = postfix
mode = 0660
user = postfix
}
}
service imap {
executable = imap after-login
}
service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
group = postfix
mode = 0660
user = postfix
}
}
service after-login {
executable = script-login /etc/dovecot/updateproxy
user = vmail
}
service stats {
unix_listener stats-reader {
group = mail
mode = 0666
}
unix_listener stats-writer {
group = mail
mode = 0666
}
}
ssl_cert = </etc/dovecot/private/dovecot.pem
ssl_cipher_list = ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:-SSLv3
ssl_key = # hidden, use -P to show it
ssl_min_protocol = SSLv3
ssl_prefer_server_ciphers = yes
userdb {
args = uid=vmail gid=vmail home=/var/vmail/%n
driver = static
}
protocol lmtp {
mail_plugins = quota sieve
postmaster_address = [email protected]
}
protocol lda {
deliver_log_format = msgid=%m: %$
mail_plugins = sieve
postmaster_address = [email protected]
quota_full_tempfail = yes
rejection_reason = Your message to <%t> was automatically rejected:%n%r
}
protocol imap {
imap_client_workarounds = delay-newmail
mail_max_userip_connections = 300
}
