Re: [vchkpw] phpbb authenticating to vpopmail/mysql
John Simpson wrote:> you're more apt to find them on a phpbb mailing list rather than the > vpopmail mailing list.I just didn't want to get into explaining what vpopmail/qmail was if it was a completely ridiculous idea. > also, a suggestion- i don't know whether your stuff works by running > "vchkpw" or by somehow calling the libvpopmail functions Two things... I actually just directly query the mysql backend that vpopmail uses with the phpbb authentication scripts. And, having typed that last line out loud, I see that this is fairly off-topic AND that I probably should have used vpopmaild! Thank you. I can't believe I didn't stumble onto that when I was trying to hatch up a solution.> from the technical end, yes. however, i'll be honest- i suspect most > of the people here also read bugtraq and know how often new security > holes are found in phpbb, and therefore aren't overly interested in > running phpbb on our servers.Indeed... the phpbb is on another server so the 'most' that [c|sh]ould be compromised is that web server's chroot and the table for that domain's mail.Thanks again for the input,Matt
[vchkpw] phpbb authenticating to vpopmail/mysql
I just finished working up this phpbb installation that authenticates (and updates the password) from amy vpopmail-mysql backend. Although I have taken more then my fair share of knowledge from open sources it's only lately that I am getting ready to give back. I thought I would ask first before I cleaned and wrote it up for the general public - is anyone even remotely interested in something like this? Sorry if this is too off-topic or whatever - I figured this crowd would have better initial input then a phpbb crowd. - matt
Re: [vchkpw] "vQadmin was unable to determine your username"
On 9/2/06, Ronald Wiplinger <[EMAIL PROTECTED]> wrote: Remo Mattei wrote:> what options do you have in your apache settings for the cgi directory?>If you would not cut the original post in your reply, than you wouldstill see it ;-)Ronald Wiplinger wrote: > Remo Mattei wrote: >> what options do you have in your apache settings for the cgi directory?>> > If you would not cut the original post in your reply, than you would > still see it ;-) Just to clarify a bit for both parties... your config file is kind of like xml, with the/ !lessthen!/directory !greaterthen! tags. Everything between those tags might not have shown up on a webmail interface or some other reason like that.Just a quick note on the error message: > **vQadmin was unable to determine your username, which> > means your webserver is improperly configured to run > > with this CGI. For security reasons, this script> > will not run without Apache htaccess lists.This covers most all of the problems, but another thing I ran into once though was that I added a user name to the htaccess list but didn't specify any permissions in the vqadmin.acl file which should be in the same directory as the vqadmin.cgiJust another $.02 USD into the pot... Regards,Matt Cornell
[vchkpw] chkuser mystery
I'm have a hell of a time tracking down why some of my user extensions won't work with chkuser. I'm running netqmail-1.05 with the qmail-toaster-0.8.1.patch from shupp.org and vpopmail-5.4.13 (on debian woody). Now, I have one .qmail-matt-default alias that works, and a new one I created (with a cp -a) .qmail-foobar-default that doesn't. To make matters even more confusing, I've set up a test qmail-smtpd service running on a different port, but with the same backend file structure, so that I could test new qmail-smtpd builds without disrupting my users. So, I rebuilt everything and started the service and I can now successfully email my .qmail-foobar-default alias. But - just for testings sake - I deleted my .qmail-foobar-default and the sent email STILL made it past the chkuser check and then I got the bounce message stating that there was no mailbox. I'm thoroughly confused. Is there some cache somewhere of the aliases and valid email addresses for my vpopmail domains? If so, where is it, when does it get refreshed? Thanks in advance, I've been searching through the list archives and readmes so it's a lack of tokens and not effort if this question has already been answered.
