If your old mail server authenticated clients using the Unix OS account and passwords
(the passwd and shadow files), you can simply enable the
Use OS Password option for those accounts and the CommuniGate
Pro Server will use the OS authentication procedures for them.
Since the OS Passwords are one-way encrypted, they cannot be used for secure
SASL authentication methods. The following procedure can be used to allow migrated
users to employ the secure SASL methods:
- enable the Use OS Password option either in the Default Account Settings or in the
Account Template.
- specify an empty string for the CommuniGate Password in the Account Template.
- import all accounts without the Password field.
Users can connect to the newly created accounts using their old OS Passwords - i.e. the
same passwords they used with the legacy mail system. When users try to modify their
account passwords, the new passwords will be stored as CommuniGate Passwords. All
users that have updated their passwords will be able to use the secure SASL authentication methods.
Sometimes you cannot use this method. For example, you migrate users from a
different server, and you do not register them all with the Unix OS on the new server,
but you do have the passwd file from the old server. In this case, you may
want to enter the Unix-style (crypt-encrypted) passwords as the CommuniGate
(internal) Passwords.
To make the CommuniGate Pro server process its internal password string as a
U-crpt (crypt-encrypted) or other support encrypted password (see below),
store the password in the Account Settings
with one-byte binary 002 prefix. If you want to create a user test using the
CLI interface, and the Unix (crypt-encrypted) password
for that user is AslUzT1JkPsocc, then use the following CLI command:
createaccount "test" {Password="\002AslUzT1JkPsocc";}
If you create users by importing
an account list from a text file, place the Unix passwords strings into the
UnixPassword column, not into the Password column. In this case, the
Loader will automatically add the binary 002 prefix to all password strings.
If you create users using the LDAP Provisioning
feature, specify the encrypted password as the unixPassword attribute.
Account Settings of the new accounts should specify one of the CommuniGate Pro
password encryption methods (clear text or A-crpt). Users will be able to log in using
their old Unix/encrypted passwords. When they update their passwords, new CommuniGate Password
strings will be stored using the specified CommuniGate Pro password encryption method.
All users that have updated their passwords will be able to use the secure SASL
authentication methods.
Some servers produced by the Netscape and Software.com companies store user passwords
using several encryption methods. When passwords are retrieved from those servers, they
have the following form:
{method}eNcoDeD
or
$method$eNcoDeD
where method specifies one of the standard encryption methods, and the eNcoDeD string
is an encrypted password (sometime - Base64-encoded).
CommuniGate Pro can use these passwords in the same way it uses the Unix-encrypted
passwords, and they should be entered in the same way: you should use the binary 002 prefix
in the CLI commands and/or your should place those passwords into the UnixPassword
field of the Account Import file.
The following encryption methods are supported:
- {crypt} - the standard Unix crypt method.
- {WM-CRY} - the standard Unix crypt method (same as {crypt})
- {MD5} - the MD5 digesting method (Base-64 encoded MD5 digest of the password string).
- {SHA} - the SHA1 digesting method (Base-64 encoded SHA1 digest of the password string).
- {NS-MTA-MD5} - the MD5-based method used in the Post.Office servers and old
Netscape Messaging servers (the eNcoDeD portion contains 64 hexadecimal digits).
- {LANM} - the "LAN Manager" hash used in Microsoft Windows servers (The eNcoDeD portion
contains 32 hexadecimal digits).
- {MSNT} - the "Microsoft NT" hash used in Microsoft Windows servers (The eNcoDeD portion
contains 32 hexadecimal digits).
- $1$ - MD5-based password hash used in FreeBSD and some other Unix systems.
- $2a$ - BlowFish-based password hash used in OpenBSD and some other Unix systems.
Sample Import file:
| Name | UnixPassword |
| user2 | YIdhkjeHDKbYsji |
| user1 | {SHA}Ue4Erbim2TC7CmuukMOBejeytr2= |
| user3 | {MD5}zverMUhsgJUIDjeytr2= |
| user4 | {crypt}YIdhkjeHDKbYsji |
| user5 | $1$VlPrB$vNjOAytB3W.j0bkkbaN2Z. |
|
| Password Type |
| Unix-crypt |
| SHA1-digested |
| MD5-digested |
| Unix-crypt, same as for the user1 account |
| BSD-type MD5-encrypted |
|
You can use a CommuniGate Pro CLI script to automatically import all users and their
passwords from the OS /etc/passwd file. See the CommuniGate
Perl Interface site for a sample script.
