[Exim] SMTP Auth problem with server_set_id and md5 hashes

Top Page
Delete this message
Reply to this message
Author: Maximiliano Kolus
Date:  
To: 'exim-users@exim.org'
CC: Guillermo Fontana
Subject: [Exim] SMTP Auth problem with server_set_id and md5 hashes
Hello!

    I'm using exim with the configuration proposed on the gnupop3d
virtual domains patch page (http://www.reedmedia.net/projects/virtualmail/).
Everything is working fine with SMTP and POP3, we are receiveing mail and
users can download mail via pop-3. The setup i have is more or less:


(file)    /etc/virtual/domains        contains the domains hosted on our
server
(dir)        /etc/virtual/domain.com        contains passwd and aliases
for "domain.com"
(dir)        /var/spool/virtual/domain.com    contains the mailboxes for
"domain.com"


    As you see, it's very simple. 


    Now we are in the need of implementing SMTP AUTH, users will
authenticate against the smtp server using their pop-3 password. In order to
achieve this, i used the $interface_address and the /etc/hosts file, when
requesting authentication, exim resolves $interface_address to a domain
using the hosts file and then open /etc/virtual/DOMAIN/passwd in order to
get the password. The result was this:


plain:
    driver=plaintext
    public_name=PLAIN
    server_condition="\
    ${if crypteq{$3}{\
        ${lookup {$2} lsearch {/etc/virtual/\
            ${extract{1}{ \t}{\
                ${lookup {$interface_address} lsearch {/etc/hosts}
{$value}}\
                }\
            }/passwd} {$value}}}\
    {yes}{no}}"
    server_set_id = $2


    It looks obfuscated but it works, i've tested the authentication and
it succeded, but there is one problem: server_set_id is null. What am i
doing wrong?


    The other question: since the passwords are already hashed, can i
use CRAM-MD5 authentication without having a plain text copy of the
password? how?.


    TIA.


-------------------------------
Maximiliano Kolus
System Engineer - AMTEC S.A.
Microsoft Certified System Engineer
mkolus@???
http://www.amtec.net

Amtec.net - The eBuilder Company of LatinAmerica