Dear Maintainer,

Encrypting the password in an sql database for sasl2 to use has been a long outstanding feature that needs to be fixed. There are currently a few methods of resolving the issue but they involve outdated patches as well as installing other packages as a work around to the solution. Fixing this issue could help resolve a major issue with sql databases and sasl2 and help promote cyrus as imap server.

The issue in question is the lack of support for the password_format: crypt option. As online security is ever more important this day and age, storing plain text passwords in a database isn't an acceptable use case. This functionality has been included with other libsasl2-modules-* packages. I honestly haven't found an answer as to why this functionality hasn't been included. If there is a reason, I apologize for the bug report but would also like an explanation so that I may document it accordingly.

Thank you for your time. I look forward to answering any more questions you may have about this issue and/or what the current fixes look like.

Best,
Alex

Recent versions of libsasl2 (including cyrus-sasl2 2.1.25.dfsg1-17) contain
support for pwcheck_method: auxprop-hashed, but unfortunately is
undocumented. The source leads me to believe that the stored value should
me an md5 hash of the shared secret.

This functionality has not been implemented in all auxprop plugins
(including ldapdb), due to the fact that it is undocumented.

Hi

I have found patch for earlier version of cyrus-sasl that adds an ability to use encrypted passwords in db.
Patch uses unix crypt().

http://pieps.org/cyrus/dist/2.1.19/cyrus-sasl-2.1.19-checkpw.c.patch

Would You please apply this or similar patch to cyrus sasl debian package?

auxprop-hashed' feature in the code. I believe it supports both sql and
sasldb auxprop backends but not ldapdb.

See git commit 62ce0768aa375cf0d16102570970b232dcb1cb28

Control: forwarded -1 https://github.com/cyrusimap/cyrus-sasl/issues/141

This feature was disabled in the latest version because it is undocumented and apparently insecure.

Please follow along about crypt() support on the upstream bug.