atom feed7 messages in net.sourceforge.lists.courier-usersRe: [courier-users] retrieving passwo...
FromSent OnAttachments
CamJul 26, 2005 2:13 pm 
Sam VarshavchikJul 26, 2005 4:08 pm 
CamJul 28, 2005 10:45 am 
Jeff JansenJul 28, 2005 12:58 pm 
Arturo 'Buanzo' BusleimanJul 28, 2005 1:42 pm 
Alexandre GhisoliJul 29, 2005 6:58 am 
Jérôme BlionJul 29, 2005 2:22 pm 
Subject:Re: [courier-users] retrieving passwords from userdb
From:Jeff Jansen (ivb_@sil.org)
Date:Jul 28, 2005 12:58:25 pm
List:net.sourceforge.lists.courier-users

Cam wrote:

the thing is i need programs other than courier to be able to read the passwords from my sql table (e.g., my mta and squirrelmail). is there any reasonable way to unencrpyt the passwords or work around this?

If the passwords in userdb are encrypted, then there's no way to get back the original passwords. However, the question is whether you actually *need* the original plaintext passwords. If you stick the hashed userdb passwords into your mysql table then courier can still use them to validate users (unless you are using CRAM authentication, in which case courier needs the passwords in plaintext).

So do these other apps need plaintext passwords or do they just need to verify passwords? Normally (forgive me if you already know all this) a program doesn't need the password in plaintext. To validate whether the password is correct, it takes the given password, encrypts it, and then compares that to the stored encrypted password. If they match then the program knows that the password is correct. But the program doesn't need to know the original password to do this. All it needs is the encrypted version.

So if you actually need your users' original passwords then you'll have to get them from your users. But perhaps you can use the hashed versions just as well.

HTH