owl-users - Re: Courier-Imap server on Owl

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

This website is powered by Openwall GNU/*/Linux security-enhanced OS

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Fri, 13 May 2005 07:45:31 +0400
From: Solar Designer <solar@...nwall.com>
To: owl-users@...ts.openwall.com
Subject: Re: Courier-Imap server on Owl

On Thu, May 12, 2005 at 02:48:54PM +0400, Melekhov Alexandre A. wrote:
> PAM_pwdb[18076]: get passwd; pwdb: request not recognized

This is described in Owl/doc/REDHAT:

| 	pam_pwdb is not tcb-aware (Red Hat Linux 6.2 and below).
| 
| The pam_pwdb module, provided for backwards compatibility with Red Hat
| Linux 6.2, is not aware of our new password shadowing scheme.  Thus,
| if you install packages from or intended for Red Hat Linux 6.2 or
| below which use PAM for authentication and you do use /etc/tcb, these
| packages will not work right.  The workaround is to edit their PAM
| configuration files to use pam_tcb instead of pam_pwdb.

Perhaps we should drop libpwdb and pam_pwdb entirely since _most_ Owl
systems do indeed use tcb.  We can even make pam_pwdb a symlink to pam_tcb.

> auth       required    /lib/security/pam_tcb.so shadow prefix=$2a$ count=8 debug
[...]
> Perhaps I was wrong making this changes?

No, you did the right thing.

Why use Courier and not dovecot, though?

-- 
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments