Dňa 26. septembra 2022 18:05:32 UTC používateľ Eric Grammatico via Exim-users <exim-users@???> napísal:
>2022-09-26 16:15:24 [10] 1ocotI-00000A-0g <= #xxxyyyy'uuss+zzz@??? H=(localhost) [45.123.190.53] P=esmtpsa X=TLS1.2:AES256-GCM-SHA384:256 CV=no A=login_server:#xxxyyyy'uuss+zzz S=736
...
>login_server:
> driver = plaintext
> public_name = LOGIN
> server_condition = ${run{/bin/sh -c "echo -e '$auth1\n$auth2' | /usr/sbin/pwauth"}{1}{0}}
> server_set_id = $auth1
> server_prompts = <| Username: | Password:
>Looks like the user #xxxyyyy'uuss+zzz is authenticated, but for sure it doesn't exist in my /etc/passwd, neither /etc/shadow
Did you try to pass that user to your script with random password?
Did you try to pass that server_condition expansion through exim -be with
that user?
Anyway, passing user input to script is not safe, notice that login name
contains the aphostrophe char, which breaks your quotation, duno how
it is interpreted... Why you do not use pam{} expansion?
regards
--
Slavko
https://www.slavino.sk/
