From 2024157e8de36edd31f5fd72f5ea7364a0955fa7 Mon Sep 17 00:00:00 2001 From: Timo Sirainen Date: Mon, 31 Aug 2009 17:21:37 -0400 Subject: [PATCH] config: Removed auth sections completely for now. They might come back in some other more generic form. --HG-- branch : HEAD --- doc/example-config/conf.d/auth.conf | 425 ++++++++++++++-------------- src/auth/auth-settings.c | 62 +--- src/auth/auth-settings.h | 10 +- src/auth/main.c | 7 +- src/config/config-parser.c | 65 +---- 5 files changed, 224 insertions(+), 345 deletions(-) diff --git a/doc/example-config/conf.d/auth.conf b/doc/example-config/conf.d/auth.conf index fa57d02201..5695066edd 100644 --- a/doc/example-config/conf.d/auth.conf +++ b/doc/example-config/conf.d/auth.conf @@ -76,230 +76,223 @@ # Number of seconds to delay before replying to failed authentications. #auth_failure_delay = 2 -auth default { - # Space separated list of wanted authentication mechanisms: - # plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey - # gss-spnego - # NOTE: See also disable_plaintext_auth setting. - auth_mechanisms = plain +# Require a valid SSL client certificate or the authentication fails. +#auth_ssl_require_client_cert = no +# Take the username from client's SSL certificate, using +# X509_NAME_get_text_by_NID() which returns the subject's DN's +# CommonName. +#auth_ssl_username_from_cert = no + +# Space separated list of wanted authentication mechanisms: +# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey +# gss-spnego +# NOTE: See also disable_plaintext_auth setting. +auth_mechanisms = plain + +## +## Password databases +## + +# +# Password database is used to verify user's password (and nothing more). +# You can have multiple passdbs and userdbs. This is useful if you want to +# allow both system users (/etc/passwd) and virtual users to login without +# duplicating the system users into virtual database. +# +# +# +# By adding master=yes setting inside a passdb you make the passdb a list +# of "master users", who can log in as anyone else. Unless you're using PAM, +# you probably still want the destination user to be looked up from passdb +# that it really exists. This can be done by adding pass=yes setting to the +# master passdb. + +# Users can be temporarily disabled by adding a passdb with deny=yes. +# If the user is found from that database, authentication will fail. +# The deny passdb should always be specified before others, so it gets +# checked first. Here's an example: + +#passdb passwd-file { + # File contains a list of usernames, one per line + #args = /etc/dovecot.deny + #deny = yes +#} + +# PAM authentication. Preferred nowadays by most systems. +# Note that PAM can only be used to verify if user's password is correct, +# so it can't be used as userdb. If you don't want to use a separate user +# database (passwd usually), you can use static userdb. +# REMEMBER: You'll need /etc/pam.d/dovecot file created for PAM +# authentication to actually work. +passdb pam { + # [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=] + # [cache_key=] [] + # + # session=yes makes Dovecot open and immediately close PAM session. Some + # PAM plugins need this to work, such as pam_mkhomedir. + # + # setcred=yes makes Dovecot establish PAM credentials if some PAM plugins + # need that. They aren't ever deleted though, so this isn't enabled by + # default. # - # Password database is used to verify user's password (and nothing more). - # You can have multiple passdbs and userdbs. This is useful if you want to - # allow both system users (/etc/passwd) and virtual users to login without - # duplicating the system users into virtual database. + # max_requests specifies how many PAM lookups to do in one process before + # recreating the process. The default is 100, because many PAM plugins + # leak memory. # - # + # cache_key can be used to enable authentication caching for PAM + # (auth_cache_size also needs to be set). It isn't enabled by default + # because PAM modules can do all kinds of checks besides checking password, + # such as checking IP address. Dovecot can't know about these checks + # without some help. cache_key is simply a list of variables (see + # doc/wiki/Variables.txt) which must match for the cached data to be used. + # Here are some examples: + # %u - Username must match. Probably sufficient for most uses. + # %u%r - Username and remote IP address must match. + # %u%s - Username and service (ie. IMAP, POP3) must match. + # + # The service name can contain variables, for example %Ls expands to + # pop3 or imap. # - # By adding master=yes setting inside a passdb you make the passdb a list - # of "master users", who can log in as anyone else. Unless you're using PAM, - # you probably still want the destination user to be looked up from passdb - # that it really exists. This can be done by adding pass=yes setting to the - # master passdb. - - # Users can be temporarily disabled by adding a passdb with deny=yes. - # If the user is found from that database, authentication will fail. - # The deny passdb should always be specified before others, so it gets - # checked first. Here's an example: - - #passdb passwd-file { - # File contains a list of usernames, one per line - #args = /etc/dovecot.deny - #deny = yes - #} - - # PAM authentication. Preferred nowadays by most systems. - # Note that PAM can only be used to verify if user's password is correct, - # so it can't be used as userdb. If you don't want to use a separate user - # database (passwd usually), you can use static userdb. - # REMEMBER: You'll need /etc/pam.d/dovecot file created for PAM - # authentication to actually work. - passdb pam { - # [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=] - # [cache_key=] [] - # - # session=yes makes Dovecot open and immediately close PAM session. Some - # PAM plugins need this to work, such as pam_mkhomedir. - # - # setcred=yes makes Dovecot establish PAM credentials if some PAM plugins - # need that. They aren't ever deleted though, so this isn't enabled by - # default. - # - # max_requests specifies how many PAM lookups to do in one process before - # recreating the process. The default is 100, because many PAM plugins - # leak memory. - # - # cache_key can be used to enable authentication caching for PAM - # (auth_cache_size also needs to be set). It isn't enabled by default - # because PAM modules can do all kinds of checks besides checking password, - # such as checking IP address. Dovecot can't know about these checks - # without some help. cache_key is simply a list of variables (see - # doc/wiki/Variables.txt) which must match for the cached data to be used. - # Here are some examples: - # %u - Username must match. Probably sufficient for most uses. - # %u%r - Username and remote IP address must match. - # %u%s - Username and service (ie. IMAP, POP3) must match. - # - # The service name can contain variables, for example %Ls expands to - # pop3 or imap. - # - # Some examples: - # args = session=yes %Ls - # args = cache_key=%u dovecot - #args = dovecot - } - - # System users (NSS, /etc/passwd, or similiar) - # In many systems nowadays this uses Name Service Switch, which is - # configured in /etc/nsswitch.conf. - #passdb passwd { - # [blocking=yes] - See userdb passwd for explanation - #args = - #} - - # Shadow passwords for system users (NSS, /etc/shadow or similiar). - # Deprecated by PAM nowadays. - # - #passdb shadow { - # [blocking=yes] - See userdb passwd for explanation - #args = - #} - - # PAM-like authentication for OpenBSD. - # - #passdb bsdauth { - # [cache_key=] - See cache_key in PAM for explanation. - #args = - #} - - # passwd-like file with specified location - # - #passdb passwd-file { - # [scheme=] [username_format=] - # - #args = - #} - - # checkpassword executable authentication - # NOTE: You will probably want to use "userdb prefetch" with this. - # - #passdb checkpassword { - # Path for checkpassword binary - #args = - #} - - # SQL database - #passdb sql { - # Path for SQL configuration file, see doc/dovecot-sql-example.conf - #args = - #} - - # LDAP database - #passdb ldap { - # Path for LDAP configuration file, see doc/dovecot-ldap-example.conf - #args = - #} - - # vpopmail authentication - #passdb vpopmail { - # [cache_key=] - See cache_key in PAM for explanation. - # [quota_template=