1 -----------------------------------------------------------------------
2 Password Plugin for Roundcube
3 -----------------------------------------------------------------------
5 Plugin that adds a possibility to change user password using many
6 methods (drivers) via Settings/Password tab.
8 -----------------------------------------------------------------------
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License version 2
11 as published by the Free Software Foundation.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License along
19 with this program; if not, write to the Free Software Foundation, Inc.,
20 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23 @author Aleksander 'A.L.E.C' Machniak <alec@alec.pl>
24 @author <see driver files for driver authors>
25 -----------------------------------------------------------------------
30 2.2. Cyrus/SASL (sasl)
31 2.3. Poppassd/Courierpassd (poppassd)
33 2.5. DirectAdmin Control Panel
40 Copy config.inc.php.dist to config.inc.php and set the options as described
47 Password plugin supports many password change mechanisms which are
48 handled by included drivers. Just pass driver name in 'password_driver' option.
54 You can specify which database to connect by 'password_db_dsn' option and
55 what SQL query to execute by 'password_query'. See main.inc.php file for
58 Example implementations of an update_passwd function:
60 - This is for use with LMS (http://lms.org.pl) database and postgres:
62 CREATE OR REPLACE FUNCTION update_passwd(hash text, account text) RETURNS integer AS $$
66 UPDATE passwd SET password = hash
67 WHERE login = split_part(account, '@', 1)
68 AND domainid = (SELECT id FROM domains WHERE name = split_part(account, '@', 2))
69 RETURNING id INTO res;
72 $$ LANGUAGE plpgsql SECURITY DEFINER;
74 - This is for use with a SELECT update_passwd(%o,%c,%u) query
75 Updates the password only when the old password matches the MD5 password
78 CREATE FUNCTION update_password (oldpass text, cryptpass text, user text) RETURNS text
81 DECLARE currentsalt varchar(20);
83 SET error = 'incorrect current password';
84 SELECT substring_index(substr(user.password,4),_latin1'$',1) INTO currentsalt FROM users WHERE username=user;
85 SELECT '' INTO error FROM users WHERE username=user AND password=ENCRYPT(oldpass,currentsalt);
86 UPDATE users SET password=cryptpass WHERE username=user AND password=ENCRYPT(oldpass,currentsalt);
92 - Plain text passwords:
93 UPDATE users SET password=%p WHERE username=%u AND password=%o AND domain=%h LIMIT 1
95 - Crypt text passwords:
96 UPDATE users SET password=%c WHERE username=%u LIMIT 1
98 - Use a MYSQL crypt function (*nix only) with random 8 character salt
99 UPDATE users SET password=ENCRYPT(%p,concat(_utf8'$1$',right(md5(rand()),8),_utf8'$')) WHERE username=%u LIMIT 1
101 - MD5 stored passwords:
102 UPDATE users SET password=MD5(%p) WHERE username=%u AND password=MD5(%o) LIMIT 1
105 2.2. Cyrus/SASL (sasl)
106 ----------------------
108 Cyrus SASL database authentication allows your Cyrus+RoundCube
109 installation to host mail users without requiring a Unix Shell account!
111 This driver only covers the "sasldb" case when using Cyrus SASL. Kerberos
112 and PAM authentication mechanisms will require other techniques to enable
113 user password manipulations.
115 Cyrus SASL includes a shell utility called "saslpasswd" for manipulating
116 user passwords in the "sasldb" database. This plugin attempts to use
117 this utility to perform password manipulations required by your webmail
118 users without any administrative interaction. Unfortunately, this
119 scheme requires that the "saslpasswd" utility be run as the "cyrus"
120 user - kind of a security problem since we have chosen to SUID a small
121 script which will allow this to happen.
123 This driver is based on the Squirrelmail Change SASL Password Plugin.
124 See http://www.squirrelmail.org/plugin_view.php?id=107 for details.
128 Change into the drivers directory. Edit the chgsaslpasswd.c file as is
129 documented within it.
131 Compile the wrapper program:
132 gcc -o chgsaslpasswd chgsaslpasswd.c
134 Chown the compiled chgsaslpasswd binary to the cyrus user and group
135 that your browser runs as, then chmod them to 4550.
137 For example, if your cyrus user is 'cyrus' and the apache server group is
138 'nobody' (I've been told Redhat runs Apache as user 'apache'):
140 chown cyrus:nobody chgsaslpasswd
141 chmod 4550 chgsaslpasswd
143 Stephen Carr has suggested users should try to run the scripts on a test
144 account as the cyrus user eg;
146 su cyrus -c "./chgsaslpasswd -p test_account"
148 This will allow you to make sure that the script will work for your setup.
149 Should the script not work, make sure that:
150 1) the user the script runs as has access to the saslpasswd|saslpasswd2
151 file and proper permissions
152 2) make sure the user in the chgsaslpasswd.c file is set correctly.
153 This could save you some headaches if you are the paranoid type.
156 2.3. Poppassd/Courierpassd (poppassd)
157 -------------------------------------
159 You can specify which host to connect to via `password_pop_host` and
160 what port via `password_pop_port`. See config.inc.php file for more info.
166 See config.inc.php file. Requires PEAR::Net_LDAP2 package.
169 2.5. DirectAdmin Control Panel
170 -------------------------------------
172 You can specify which host to connect to via `password_directadmin_host`
173 and what port via `password_direactadmin_port`. See config.inc.php file
180 Driver file (<driver_name>.php) must define 'password_save' function with
181 two arguments. First - current password, second - new password. Function
182 may return PASSWORD_SUCCESS on success or any of PASSWORD_CONNECT_ERROR,
183 PASSWORD_CRYPT_ERROR, PASSWORD_ERROR when driver was unable to change password.
184 See existing drivers in drivers/ directory for examples.