imapext-2007
view docs/md5.txt @ 0:ada5e610ab86
imap-2007e
| author | yuuji@gentei.org |
|---|---|
| date | Mon, 14 Sep 2009 15:17:45 +0900 |
| parents | |
| children |
line source
1 /* ========================================================================
2 * Copyright 1988-2006 University of Washington
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 *
11 * ========================================================================
12 */
14 MD5 Based Authentication
15 Mark Crispin
16 1 November 1999
19 The IMAP toolkit makes available two MD5 based authentication
20 mechanisms, CRAM-MD5 and APOP. CRAM-MD5 is described in RFC 2195, and
21 is a SASL (RFC 2222) authentication mechanism. APOP is described in
22 RFC 1939, the standard document for the POP3 protocol.
24 These mechanisms use the same general idea. The server issues a
25 challenge; the client responds with an MD5 checksum of the challenge
26 plus the password; the server in compares the client's response with
27 its own calculated value of the checksum. If the client's response
28 matches the server's calulated value, the client is authenticated.
30 Unlike plaintext passwords, this form of authentication is
31 believed to be secure against the session being monitored; "sniffing"
32 the session will not disclose the password nor will it provide usable
33 information to authenticate in another session without knowing the
34 password.
36 The key disadvantage with this form of authentication is that the
37 server must know a plaintext form of the password. In traditional
38 UNIX authentication, the server only knows an encrypted form of the
39 password. Consequently, the authentication database for this form of
40 authentication must be kept strictly confidential; a bad guy who
41 acquires access to this database can access any account in the
42 database.
44 CRAM-MD5 client support is implemented unconditionally; any
45 client application built with the IMAP toolkit will use CRAM-MD5 with
46 any server which advertises CRAM-MD5 SASL support.
48 CRAM-MD5 and APOP server support is implemented if, and only if,
49 the CRAM-MD5 authentication database exists. By default, the CRAM-MD5
50 authentication database is in a UNIX file called
51 /etc/cram-md5.pwd
52 It is recommended that this file be protected 0400.
54 NOTE: FAILURE TO PROTECT THIS FILE AGAINST UNAUTHORIZED
55 ACCESS WILL COMPROMSE CRAM-MD5 AND APOP AUTHENTICATION
56 FOR ALL USERS LISTED IN THIS DATABASE.
58 If the CRAM-MD5 authentication database exists, then plaintext
59 password authentication (e.g. the LOGIN command) will also use the
60 CRAM-MD5 passwords instead of UNIX passwords. Alternatively, it is
61 possible to build the IMAP toolkit so that plaintext password
62 authentication is disabled entirely, by using PASSWDTYPE=nul, e.g.
63 make aix PASSWDTYPE=nul
66 The CRAM-MD5 authentication database file consists of a series of
67 text lines, consisting of a UNIX user name, a single tab, and the
68 password. A line starting with a "#" character is ignored, as are any
69 lines which are not in valid format. For example:
71 ------------------------------Sample------------------------------
72 # CRAM-MD5 authentication database
73 # Entries are in form <user><tab><password>
74 # Lines starting with "#" are comments
76 bill hubba-hubba
77 hillary nysenator
78 monica beret
79 tripp wired
80 kenstarr inquisitor
81 reno waco
82 jessie thebody
83 billgates ruleworld
84 ------------------------------Sample------------------------------
86 Every entry in the CRAM-MD5 authentication database must have a
87 corresponding entry in the /etc/passwd file. It is STRONGLY
88 RECOMMENDED that the CRAM-MD5 password NOT be the same as the
89 /etc/passwd password. It is permitted for the /etc/passwd password to
90 be disabled; /etc/passwd is just used to get the UID, GID, and home
91 directory information.