/[mailutils]/mailutils/doc/texinfo/programs.texi
ViewVC logotype

Diff of /mailutils/doc/texinfo/programs.texi

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.16 by sroberts, Tue Apr 16 03:33:31 2002 UTC revision 1.17 by gray, Wed Aug 14 12:09:51 2002 UTC
# Line 6  Line 6 
6  GNU Mailutils provides a set of programs for handling the email.  GNU Mailutils provides a set of programs for handling the email.
7    
8  @menu  @menu
9    * authentication:: Authorization and authentication principles.        
10  * configuration:: Common configuration file.  * configuration:: Common configuration file.
11  * imap4d::        IMAP4 daemon.  * imap4d::        IMAP4 daemon.
12  * pop3d::         POP3 daemon.  * pop3d::         POP3 daemon.
# Line 20  GNU Mailutils provides a set of programs Line 21  GNU Mailutils provides a set of programs
21  @end menu  @end menu
22    
23  @page  @page
24    @node authentication
25    @section Authorization and authentication principles.        
26    @cindex authorization
27    @cindex authentication
28    
29    Some mail utilities provide access to their services only after
30    verifying that the user is actually the person he is claiming
31    to be. Such programs are, for example, @command{pop3d} and
32    @command{imap4d}. The process of the verification is broken
33    down into two stages: @dfn{authorization} and @dfn{authentication}.
34    In @dfn{authorization} stage the program retrieves the information
35    about a particular user. In @dfn{authentication} stage, this information
36    is compared against the user-supplied credentials. Only if both stages
37    succeed is the user allowed to use the service.
38    
39    A set of @dfn{modules} is involved in performing each stage. For
40    example, the authorization stage can retrieve the user description
41    from various sources: system database, sql database, virtual domain
42    table, etc. Each module is responsible for retrieving the description
43    from a particular source of information. The modules are arranged in
44    a @dfn{module list}. The modules from the list are invoked in turn, until
45    either a one of them succeeds or the list is exhausted. In latter case
46    the authorization fails. Otherwise the data returned by the succeeded
47    module are used in authentication.
48    
49    Similarly, authentication may be performed in several ways. The
50    authentication modules are also grouped in a list. Each module
51    is tried in turn until either a module succeeds, in which case the
52    authentication succeeds, or the end of the list is reached.
53    
54    We represent the module lists as column-separated lists of module
55    names. For example, the authorization list
56    
57    @example
58            system:sql:virtdomains
59    @end example
60    
61    @noindent
62    means that first the system user database (@file{/etc/password}) is
63    searched for a description of a user in question. If the search fails,
64    the @acronym{sql} database is searched. Finally, if it also fails, the
65    search is performed in the virtual domain database.
66    
67    @emph{Note}, that some authentication and/or authorization modules may
68    be disabled when configuring the package before compilation. The names
69    of the disabled modules are nevertheless available for use in runtime
70    configuration options, but they represent a ``fail-only'' functionality,
71    e.g. if the package was compiled without @acronym{sql} support then the
72    module @samp{sql} in the above example will always fail, thus passing
73    the execution on to the next module.
74    
75    The modules available for use in authorization list are:
76    
77    @table @asis
78    @item system
79    User credentials are retrieved from the system user database
80    (@file{/etc/password}).
81    @item sql
82    User credentials are retrieved from the @acronym{sql} database. The set
83    of @option{--sql-} options (@pxref{auth}) is used to configure
84    access to the database.
85    @item virtdomain
86    User credentials are retrieved from a ``virtual domain'' user
87    database.
88    @end table
89    
90    The modules available for use in authentication list are:
91    
92    @table @asis
93    @item generic
94    The generic authentication type. User password is hashed and compared
95    against the hash value returned in authorization stage.
96    @item system
97    The hashed value of the user password is retrieved from
98    @file{/etc/shadow} file on systems that support it.
99    @item sql
100    The hashed value of the user password is retrieved from the @acronym{sql}
101    database using query supplied by @option{--sql-getpass} option
102    (@pxref{auth}).
103    @item pam
104    The user is authenticated via pluggable authentication module
105    (@acronym{pam}). The @acronym{pam} service name to be used is
106    configured via @option{--pam-service} option (@pxref{auth})
107    @end table
108    
109    Unless overridden by @option{--authentication} command line option,
110    the list of authentication modules is:
111    
112    @example
113            generic:system:pam:sql
114    @end example
115    
116    @noindent
117    Unless overridden by @option{--authorization} command line option,
118    the list of authorization modules is:
119    
120    @example
121            system:sql:virtdomains
122    @end example
123    
124    @page
125  @node configuration  @node configuration
126  @section Mailutils configuration file  @section Mailutils configuration file
127  @cindex Mailutils configuration file  @cindex Mailutils configuration file
# Line 193  of seconds. Line 295  of seconds.
295  @subsection auth --- Authentication-specific options.  @subsection auth --- Authentication-specific options.
296  @cindex :auth  @cindex :auth
297    
298    These options control the authorization and authentication module
299    lists. For a description of auhtentication concepts, refer to
300    @xref{authentication}.
301    
302  @table @option  @table @option
303    @item --authorization @var{modlist}
304    
305    This option allows to set up a list of modules to be used for
306    authorization. @var{modlist} is a colon-separated list of
307    modules. Valid modules are:
308    
309    @table @asis
310    @item system
311    User credentials are retrieved from the system user database
312    (@file{/etc/password}).
313    @item sql
314    User credentials are retrieved from the @acronym{sql} database. The set
315    of @option{--sql-} options (see below) is used to configure
316    access to the database.
317    @item virtdomain
318    User credentials are retrieved from a ``virtual domain'' user
319    database.
320    @end table
321    
322    @item --authentication @var{modlist}
323    
324    This option allows to set up a list of modules to be used for
325    authentication. @var{modlist} is a colon-separated list of
326    modules. Valid modules are:
327    
328    @table @asis
329    @item generic
330    The generic authentication type. User password is hashed and compared
331    against the hash value returned in authorization stage.
332    @item system
333    The hashed value of the user password is retrieved from
334    @file{/etc/shadow} file on systems that support it.
335    @item sql
336    The hashed value of the user password is retrieved from the @acronym{sql}
337    database using query supplied by @option{--sql-getpass} option
338    (see below).
339    @item pam
340    The user is authenicated via pluggable authentication module
341    (@acronym{pam}). The @acronym{pam} service name to be used is
342    configured via @option{--pam-service} option (see below)
343    @end table
344    
345  @item --pam-service @var{name}  @item --pam-service @var{name}
346  When compiled with @acronym{pam} support, this option specifies the  When compiled with @acronym{pam} support, this option specifies the
347  name of @acronym{pam} service to be used when authenticating.  name of @acronym{pam} service to be used when authenticating.
348  @end table  @end table
349    
350  The following options exist in this group if the package was configured  The following options exist in this group if the package was configured
351  with @samp{--enable-sql} option:  with @option{--enable-sql} option. They take effect only if the
352    @samp{sql} module is used in authentication and/or authorization.
353    Currently only MySQL is supported.  
354    
355  @table @option  @table @option
356  @item sql-getpwnam @var{query}  @item --sql-getpwnam @var{query}
357  SQL query to retrieve a passwd entry based on username  @acronym{sql} query to retrieve a passwd entry based on username
358  @item sql-getpwuid @var{query}  @item --sql-getpwuid @var{query}
359  @item sql-getpass @var{query}  @item --sql-getpass @var{query}
360  SQL query to retrieve a password from the database  @acronym{sql} query to retrieve a password from the database
361  @item sql-host @var{name}  @item --sql-host @var{name}
362  Name or IP of MySQL server to connect to.  Name or IP of MySQL server to connect to.
363  @item sql-user @var{name}  @item --sql-user @var{name}
364  SQL user name  @acronym{sql} user name
365  @item sql-passwd @var{string}  @item --sql-passwd @var{string}
366  SQL connection password  @acronym{sql} connection password
367  @item sql-db @var{string}  @item --sql-db @var{string}
368  Name of the database to connect to.  Name of the database to connect to.
369  @item sql-port @var{number}  @item --sql-port @var{number}
370  Port to use  Port to use
371  @end table  @end table
372    
# Line 246  facility @samp{local1}. Line 396  facility @samp{local1}.
396  @example  @example
397  @group  @group
398  :mailbox --mail-spool /var/spool/mail  :mailbox --mail-spool /var/spool/mail
399  :auth --pam-service mailutils  :auth --authentication pam --pam-service mailutils
400  :logging --log-facility mail  :logging --log-facility mail
401  imap4d --daemon=20 --timeout=1800 --log-facility local1  imap4d --daemon=20 --timeout=1800 --log-facility local1
402  @end group  @end group

Legend:
Removed from v.1.16  
changed lines
  Added in v.1.17

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26