I could be barking up the wrong tree here but...

Perhaps did you configure vpopmail to "learn passwords" ?

It rings a bell for me that if you upgrade from an v4.x vpopmail, and you
enable clear passwords in your v5.2 vpopmail, you loose all your existing
passwords and the general way to recover from this is to enable vpopmail's
"learn passwords" functionality

This could explain why "any password works". But then again, once the
password has been learned, you shouldn't be able to go back and use some
other password and still get access


----- Original Message ----- 
From: "jeff thomas" <[EMAIL PROTECTED]>
Sent: Wednesday, August 13, 2003 10:15 AM
Subject: [vchkpw] Urgent - vchkpw/vpopmail authenticate even with wrong pw?

> Hello -
> I recently installed vpopmail 5.3.20 from freebsd
> ports. I used Matt Simerson's FreeBSD Qmail Toaster
> scripts to install it (it uses ports).
> That installed without problem. I installed
> courier-imap and squirrelmail as well as sqwebmail. I
> noticed today that I can log into any of the accounts
> via sqwebmail with any password. I can literally put
> in "xxx" for the password on my e-mail account and it
> will let me in. I tried it on squirrelmail with the
> same problem. So, then I tried simply logging into the
> POP3 account with "xyz" as the password. It, too, let
> me in with full access.
> This is bad - obviously. Anyone care to shed some
> light on what I need to do to get this fixed ASAP. I
> upgraded from 4.9.x and use mysql4 for authentication.
> Any and all help is appreciated.
> __________________________________
> Do you Yahoo!?
> Yahoo! SiteBuilder - Free, easy-to-use web site design software
> http://sitebuilder.yahoo.com

Reply via email to