install/mailsystem
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

install_update_dovecot: do not log attempted passwords

Browse Source 
Set auth_verbose_passwords to 'no'. 'plain' and 'yes' write attempted
passwords in cleartext to the log, including the real passwords of users
who only made a typo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
chris
2026-11-08 14:55:13 +01:00
co-authored by Claude Opus 5.5
parent 4f33f3d426
commit 15aca2f34b
2 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install_update_dovecot-2.3.sh
+2 -2
View File
@@ -2200,7 +2200,7 @@ fi
## - log_path = syslog ## - log_path = syslog
## - syslog_facility = local1 ## - syslog_facility = local1
## - auth_verbose = yes ## - auth_verbose = yes
## - auth_verbose_passwords = plain ## - auth_verbose_passwords = no
## - ## -
## - in conjunction with the the following entries in /etc/rsyslog.conf ## - in conjunction with the the following entries in /etc/rsyslog.conf
## - ## -
@@ -2219,7 +2219,7 @@ perl -i -n -p -e "s#^([ ]*)\#?\ ?(syslog_facility\ ?=.*)#\1\#\# \2\n\1syslog_fac
/usr/local/dovecot-${_version}/etc/dovecot/conf.d/10-logging.conf || _failed=true /usr/local/dovecot-${_version}/etc/dovecot/conf.d/10-logging.conf || _failed=true
perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose\ ?=.*)#\1\#\# \2\n\1auth_verbose = yes#g" \ perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose\ ?=.*)#\1\#\# \2\n\1auth_verbose = yes#g" \
/usr/local/dovecot-${_version}/etc/dovecot/conf.d/10-logging.conf || _failed=true /usr/local/dovecot-${_version}/etc/dovecot/conf.d/10-logging.conf || _failed=true
perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose_passwords\ ?=.*)#\1\#\# \2\n\1auth_verbose_passwords = plain#g" \ perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose_passwords\ ?=.*)#\1\#\# \2\n\1auth_verbose_passwords = no#g" \
/usr/local/dovecot-${_version}/etc/dovecot/conf.d/10-logging.conf || _failed=true /usr/local/dovecot-${_version}/etc/dovecot/conf.d/10-logging.conf || _failed=true
if ! $_failed ; then if ! $_failed ; then
install_update_dovecot-2.4.sh
+10 -5
View File
@@ -6874,7 +6874,7 @@ if [[ $dovecot_major_version -gt 2 ]] \
# log_path =syslog # log_path =syslog
# syslog_facility = local1 # syslog_facility = local1
# auth_verbose = yes # auth_verbose = yes
# auth_verbose_passwords = plain # auth_verbose_passwords = no
# #
# #
# in conjunction with the the following entries in /etc/rsyslog.conf # in conjunction with the the following entries in /etc/rsyslog.conf
@@ -6949,7 +6949,9 @@ EOF
if grep -qE "^\s*auth_verbose_passwords\s*=" "${_conf_file}"; then if grep -qE "^\s*auth_verbose_passwords\s*=" "${_conf_file}"; then
replace_variable "auth_verbose_passwords" "yes" "${_conf_file}" || _failed=true # - Never log attempted passwords: 'yes' and 'plain' write them in cleartext to
# - the log, including the real passwords of users who only made a typo.
replace_variable "auth_verbose_passwords" "no" "${_conf_file}" || _failed=true
else else
@@ -6962,7 +6964,10 @@ EOF
# #
# plain, yes: Output cleartext password (NOT RECOMMENDED) # plain, yes: Output cleartext password (NOT RECOMMENDED)
# sha1: Output SHA1 hashed password # sha1: Output SHA1 hashed password
auth_verbose_passwords = plain #
# Never log attempted passwords: they also contain real passwords of users
# who only made a typo.
auth_verbose_passwords = no
EOF EOF
fi fi
@@ -7000,7 +7005,7 @@ else
## - log_path = syslog ## - log_path = syslog
## - syslog_facility = local1 ## - syslog_facility = local1
## - auth_verbose = yes ## - auth_verbose = yes
## - auth_verbose_passwords = plain ## - auth_verbose_passwords = no
## - ## -
## - in conjunction with the the following entries in /etc/rsyslog.conf ## - in conjunction with the the following entries in /etc/rsyslog.conf
## - ## -
@@ -7018,7 +7023,7 @@ else
${_conf_file} || _failed=true ${_conf_file} || _failed=true
perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose\ ?=.*)#\1\#\# \2\n\1auth_verbose = yes#g" \ perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose\ ?=.*)#\1\#\# \2\n\1auth_verbose = yes#g" \
${_conf_file} || _failed=true ${_conf_file} || _failed=true
perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose_passwords\ ?=.*)#\1\#\# \2\n\1auth_verbose_passwords = plain#g" \ perl -i -n -p -e "s#^([ ]*)\#?\ ?(auth_verbose_passwords\ ?=.*)#\1\#\# \2\n\1auth_verbose_passwords = no#g" \
${_conf_file} || _failed=true ${_conf_file} || _failed=true
if ! $_failed ; then if ! $_failed ; then