Mark wrote:
>
> I'm using an md5-based crypt() (default Slack 7.0, without des1 package),
> but vpopmail (4.9.6-1) appears to be using DES encryption for its
> passwords. Basically, unless Slack puts it somewhere on my system without
> telling me, des-based crypt() doesn't exist on my system (before vpopmail,
> at least). Would it be possible to cause vpopmail to use the system
> crypt() instead of whatever it's using?
>
> If this is consistent with vpopmail on all platforms, then the above
> change would help users migrating from sendmail or qmail + checkpasswd to
> vpopmail without reissuing passwords -- just copy the fields from
> /etc/shadow into domain.com/vpasswd.
>
> If this is not consistent with vpopmail on other platforms (ie: it uses
> system crypt(), be it md5 or des, but mine is weird), thats cool too :)
> Gives me more to look at :)
>
> thanks,
> mark
vpopmail uses the crypt() system call to do encrypt password
comparisions against /etc/passwd and vpopmail password files.
if (!sstrcmp(curr,crypt(supp,curr))) return 2;
The problem you are is a Slackware only problem.
I've personally seen it on a slackware system.
I've personally not experienced this problem on:
Redhat 6.1, 6.2, 7.0
Mandrake
Solaris 5.6, 5.7, 5.8
Dec OSF1
Caldera
Debian
(plus other I don't remember)
I tracked down the Slackware problem to this:
1) Slackware compiles a working crypt library into it's distributed
binaries
2) Slackware distributes a crypt library that is not compatible with
the binaries.
3) You can download the compatible crypt library and install it on
your system from one of the Slackware sites. Then recompile vpopmail.
Aparently the issue stems from the Slackware distro not wanting
to run afowl of cryptographic export laws. So they distributed
a non functional crypt library. They make the real crypt library
available, but make you get it for yourself. That shifts the
blame from them to you (i.e. crypto export laws)
Ken Jones
