New Version of E-mail, FTP, and SQL Password Changer

[N!Ce]

(07-07-2010 05:31 PM)joximu Wrote:  It seems not to be changed in the userdb of imap (where squirrel authenticates). So also the pop and imap passwords should be unchanged -> please verify.

See that is the first point, I thought SM would directly read/write the user credentials from the ispcp DB. At least until that problem occured.

Can you tell me where I can find the IMAP userdb please?
I found the pref files in /var/www/ispcp/gui/tools/webmail/data but not sure if there is something besides those.

And thanks for the reply.

[joximu]

if you use the courier imap (and not dovecot - which reads the password in the db) - have a look at /etc/courier/userdb* - but the passwords there are hashed.
The smtp auth passwords ares stored in /etc/sasldb2 and if you're lucky you will see the passwords in cleartext like "mypassword.user.domain.tld.userPassword"...

But when I wrote check the passwords I thought about using a pop3 client (or telnet on port 110 and log in like pop3 protocol...)

/J

[N!Ce]

(07-08-2010 08:10 AM)joximu Wrote:  if you use the courier imap (and not dovecot - which reads the password in the db)

I got courier installed. Are there any issues with switching to dovecot, particularly concerning ispCP? What would be the advantages disadvantages?

According to the general feedback I gathered with Google, it seems most people prefer dovecot anyway (faster, more secure etc.).

I am not too fond of having confidential data saved to and read from two different sources twice.

Dovecot is likely to resolve this issue as well, as you say it reads directly from the DB.

EDIT:
Is this tutorial still valid or outdated yet? As it is a bit old (2009-02-25).

[joximu]

well - dovecot really maybe the better MDA and in future versions of ispcp maybe dovecot will be used...
But until now everyone has to decide which MDA fits best.

The issue is not solved with dovecot but then it doesn't matter anymore :-/


/J

[N!Ce]

Okay, I finally got around migrating to dovecot. Everything works fine so far, including the password changer which works now as well.

There were some difficulties on the way, but thanks God I got them all solved with help of Google and this Forum.

Thanks again for your help, your dovecot hint was invaluable.

Quote:The issue is not solved with dovecot but then it doesn't matter anymore

True, but why would I bother with courier issues when I decided to switch to dovecot. =X

[grisu]

I got the cause for my problem.... I have to be logged onto the (official) ISPCP backend/panel. Then the pw-changer works. It works NOT, when not a user is logged in into the ISPCP panel.

Is this a wanted behaviour? I just wanted to give users the possibility to change their email password WITHOUT giving them the credentials to the domain-administration.

What other suggestions do you make? Change to dovecot/roundcube and use the pw-changer plugin on this site?

[grisu]

edit
I figured out the following:
If I open changepassword.php it will create a cookie (as normal) called 'ispCP' which has as content the session-ID in it.
The problem is: the session is not written into the database ispcp => table: login
After this the captcha check (and ip address etc) will fail.

For me it seems to be a bug, right? You can reproduce it, if you make sure, you delete both... the content in database ispcp, table login (all entries) AND the cookie in your browser.

I'd also suggest a solution but I need to know WHERE in ispcp the session handling is made (to get the functions and so).

[Jadawin]

Is there a new version that works with 1.0.7? :/

Ticket says milestone 1.2.0, very bad...
http://isp-control.net/ispcp/ticket/2263


Jadawin