Roundcube/Plugin/password: Unterschied zwischen den Versionen

Versionsgeschichte interaktiv durchsuchen

VisuellWikitext

Aktuelle Version vom 7. Juli 2026, 12:03 Uhr

Roundcube/Plugin/password

Beschreibung

shipped with Roundcube
You can use either vpopmaild or sql driver

This plugin provides some driver to enforce the password strenght and I tryied zxcvbn with no success

Fortunately Tony Fung explained in a comment how to patch the plugin to use cracklib as a password strenght library
If you want to use this approach read below

Driver

vpopmaild

# cd plugins/password
# cp -p config.inc.php.dist config.inc.php
# nano config.inc.php

$config['password_driver'] = 'vpopmaild';

// Determine whether the current password is required to change the password
// Default: false.
$config['password_confirm_current'] = true;

// vpopmaild Driver options
// -----------------------
// The host which changes the password
$config['password_vpopmaild_host'] = '<mail-server-IP>';

// TCP port used for vpopmaild connections
$config['password_vpopmaild_port'] = 89;

Remember to replace <mail-server-IP> with the IP address of your MTA (generally localhost)

sql

// We have MYSQL for our VPOPMAIL DATABASE so we use the sql driver
$config['password_driver'] = 'sql';

// Determine whether current password is required to change password.
// Default: false.
$config['password_confirm_current'] = true;

// SQL Driver options
// ------------------
// PEAR database DSN for performing the query. By default
// Roundcube DB settings are used.
// We have a VPOPMAIL DB and the database and table name is vpopmail
$config['password_db_dsn'] =
'mysql://vpopmail:YOURPASSWORDGOESHERE@<mysql-IP>/vpopmail';

// The username and domainname are different columns JDT
$config['password_query'] = 'UPDATE vpopmail set
pw_passwd=ENCRYPT(%p,concat("$1$",right(md5(rand()),8),"$")),
 pw_clear_passwd=%p where pw_name=%l and pw_domain=%d';

// VPOPMAIL uses salted hash so md5 JDT
$config['password_crypt_hash'] = 'md5';

Here <mysql-IP> is the IP address of your sql server (put localhost if qmail and sql servers share the same IP)

Cracklib

Cracklib patch

You may want to patch the plugin to gain cracklib's security benefits (thanks to Tony Fung for the patch), so that both roundcube and qmailadmin share the same password check system:

cd /var/www/roundcube
wget https://notes.sagredo.eu/files/qmail/patches/roundcube/cracklib-roundcube_pwd_plugin.patch
patch -p1 < cracklib-roundcube_pwd_plugin.patch

Be aware that the cracklib library must be installed as already explained in the qmailadmin's page. You also have to remove exec from disable_functions in your php.ini

Konfiguration

Dateien

Datei	Beschreibung

Anhang

Siehe auch

Dokumentation

Links

Projekt

Weblinks

@@ Zeile 1: / Zeile 1: @@
-== Password ==
+<noinclude>
+<!--
+----
+{{Navigation|<zurück>|<nachste>}}
+----
+-->
+'''{{BASEPAGENAME}}'''
+</noinclude>
-* Plugin name: ''password''
+== Beschreibung ==
+* shipped with Roundcube
+* You can use either <code>vpopmaild</code> or <code>sql</code> driver
-This is shipped with Roundcube, so it doesn't need to be installed. You can use either <code>vpopmaild</code> or <code>sql</code> driver (thanks to John D. Trolinger).
+This plugin provides some driver to enforce the password strenght and I tryied <code>zxcvbn</code> with no success
+* Fortunately Tony Fung explained in a comment how to patch the plugin to use <code>cracklib</code> as a password strenght library
+* If you want to use this approach read below
-This plugin provides some driver to enforce the password strenght and I tryied <code>zxcvbn</code> with no success. Fortunately Tony Fung explained in a comment how to patch the plugin to use <code>cracklib</code> as a password strenght library. If you want to use this approach read below.
+=== Driver ===
+==== vpopmaild ====
-=== Choosing the vpopmaild driver ===
   # cd plugins/password
   # cp -p config.inc.php.dist config.inc.php
@@ Zeile 14: / Zeile 24: @@
   $config['password_driver'] = 'vpopmaild';
-  // Determine whether current password is required to change password.
+  // Determine whether the current password is required to change the password
   // Default: false.
   $config['password_confirm_current'] = true;
@@ Zeile 23: / Zeile 33: @@
   $config['password_vpopmaild_host'] = '<mail-server-IP>';
-  // TCP port used for vpopmaild connections
+  // [[TCP]] port used for vpopmaild connections
   $config['password_vpopmaild_port'] = 89;
-Remember to replace <mail-server-IP> with the IP address of your MTA (generally localhost).
+Remember to replace <mail-server-IP> with the IP address of your MTA (generally localhost)
-=== Choosing the sql driver ===
+==== sql ====
   // We have MYSQL for our VPOPMAIL DATABASE so we use the sql driver
   $config['password_driver'] = 'sql';
@@ Zeile 39: / Zeile 49: @@
   // PEAR database DSN for performing the query. By default
   // Roundcube DB settings are used.
-  // We have a VPOPMAIL DB  and the database and table name is vpopmail
+  // We have a VPOPMAIL DB and the database and table name is vpopmail
   $config['password_db_dsn'] =
   'mysql://vpopmail:YOURPASSWORDGOESHERE@<mysql-IP>/vpopmail';
@@ Zeile 45: / Zeile 55: @@
   // The username and domainname are different columns JDT
   $config['password_query'] = 'UPDATE vpopmail set
-  pw_passwd=ENCRYPT(%p,concat("$1$",right(md5(rand()),8 ),"$")),
+  pw_passwd=ENCRYPT(%p,concat("$1$",right(md5(rand()),8),"$")),
-   pw_clear_passwd=%p where pw_name=%l and pw_domain=%d';
+  pw_clear_passwd=%p where pw_name=%l and pw_domain=%d';
   // VPOPMAIL uses salted hash so md5 JDT
   $config['password_crypt_hash'] = 'md5';
-Here <mysql-IP> is the IP address of your sql server (put localhost if <code>qmail</code> and <code>sql</code> servers share the same IP).
+Here <mysql-IP> is the IP address of your sql server (put localhost if <code>qmail</code> and <code>sql</code> servers share the same IP)
-=== <code>Cracklib</code> patch ===
+=== Cracklib ===
+; Cracklib patch
 You may want to patch the plugin to gain <code>cracklib</code>'s security benefits (thanks to Tony Fung for the patch), so that both roundcube and qmailadmin share the same password check system:
   cd /var/www/roundcube
   wget <nowiki>https://notes.sagredo.eu/files/qmail/patches/roundcube/cracklib-roundcube_pwd_plugin.patch</nowiki>
   patch -p1 < cracklib-roundcube_pwd_plugin.patch
-Be aware that the <code>cracklib</code> library must be installed as already explained in the qmailadmin's page. You also have to remove <code>exec</code> from <code>disable_functions</code> in your <code>php.ini</code>.
+Be aware that the <code>cracklib</code> library must be installed as already explained in the qmailadmin's page. You also have to remove <code>exec</code> from <code>disable_functions</code> in your <code>php.ini</code>
+== Konfiguration ==
+=== Dateien ===
+{| class="wikitable options big"
+|-
+! Datei !! Beschreibung
+|-
+| ||
+|-
+| ||
+|}
+<noinclude>
+<!--
+----
+{{Navigation|<zurück>|<nachste>}}
+----
+-->
+== Anhang ==
+=== Siehe auch ===
+<div style="column-count:2">
+<categorytree hideroot=on mode="pages">Roundcube/Plugin</categorytree>
+</div>
+----
+{{Special:PrefixIndex/Roundcube/Plugin}}
+=== Dokumentation ===
+<!--
+; Man-Page
+# [https://manpages.debian.org/stable/procps/pgrep.1.de.html prep(1)]
+; Info-Pages
+-->
+=== Links ===
+==== Projekt ====
+==== Weblinks ====
+<!--
+{{DEFAULTSORT:new}}
+{{DISPLAYTITLE:new}}
+-->
+[[Kategorie:Roundcube/Plugin]]
+</noinclude>

Dirkwagner (Diskussion | Beiträge)