Search code examples
postgresqlemailpasswordspostfix-mtadovecot

Dovecot with PostgreSQL users database: Password hashing

I'm trying to set up a Mail Server using Postfix and Dovecot.

I have my users stored in a PostgreSQL database with bcrypt hashed passwords.

After some researching, I found ways to read users from a PostgreSQL database, but with passwords stored in plain text.

How do I set up Dovecot to read users from a PostgreSQL database with bcrypt hashed passwords?

Solution

  • Dovecot fully supports the BLF-CRYPT password scheme since the recent 2.3 release apparently.

    It shouldn't make a difference for PostgreSQL what kind of scheme is used, the password is just a text field in the database and it's stored and retrieved in its hashed textual form. The scheme used to hash is known by the first few characters of the password, for instance $2a$ for bcrypt.

    Hashing the password can be can be done with doveadm -s BLF-CRYPT and the output copied into the password field of the database in the row corresponding to the user.

    For the authentication, dovecot, like postfix, expects a user-supplied SQL query with some documented placeholders in its configuration (see password_query), so it doesn't need to assume any particular structure of a table or view of users.