Each email address within PowerMail has an entry in the Userbase. Any email address offered to PowerMail over the internet is in three categories, 'Unknown', 'Hosted', or 'Forward'. Unkown email addresses are refused immediately - email is not accepted first and bounced later.
Mail for Hosted addresses is stored on any of the pptalker
backends, and can from there on be retrieved over
the POP interface, if the proper password is supplied.
Email is not stored infinitely - a quota can be set which limits the amount of storage any mailbox can occupy for itself. Note that due to the hardlinking nature of PowerMail, it is possible for individual mailboxes to exceed their quota if the messages are shared with other users. This means that a 'message to everybody' will always arrive, even if the user is over quota. See also Section 11.2.
'Forward' addresses are proxied directly to an outgoing mailserver and do not enter PowerMail as such. PowerMail as such does not send out messages, it leaves that job to a outgoing capable mailserver.
Passwords can be stored in:
Plaintext ({plain})
Standard unix crypt(3) ({crypt})
Standard unix md5 ({md5})
PowerMail 1.0.0 only supported plaintext passwords and these did not need to be prefixed in any way. So, to have a user with password 's3cr3t!', any userbase would contain just 's3cr3t!'. As of version 1.1.0 however, multiple schemas are available.
The schema is indicated by prefixing the password or hash in the database with a marker. For example, the new preferred way to store the password above is '{plain}s3cr3t!'. When using UNIX crypt, it might look like this: '{crypt}/CFF1gJfAFAqM'. When using md5 hashes, a $1$ prefix needs to be present, and our database might contain '{md5}$1$Wh/8PmbX$tLpq3mPsvT5gdVJcVVYXA1' which matches 's3cr3t!'.
Crypts and hashes can be calculated using the pptool convenience functions crypt
and md5
as described in Section 7.1.1.
![]() | Apache htpasswd generates MD5 hashes which are not compatible with PowerMail. PowerMail is compatible with /etc/shadow or /etc/passwd hashes. |
For historical reasons, unprefixed passwords are treated as if they were prefixed by '{plain}'. However, this means that users which previously had passwords that started with a '{' and contained a '}' somewhere are no longer able to login.
![]() | When upgrading from 1.0.0 or earlier, it is highly advised to prefix all plaintext passwords with {plain} in all userbases! Not doing so may cause users with passwords starting with '{' and containg a '}' to not be able to log in! |
In the near future, '{sha1}' is also expected to make an appearance.
As of version 1.7 PowerPOP has (some) support for the APOP pop3 command. You can read about the APOP command in rfc 1939 and here.
APOP is a method of sending the password encrypted (md5) over the network, so password sniffing can not be done but the e-mail retrieved from PowerPOP wil not be encrypted in any way. APOP it is not completely secure, brute force hacking is still posible!
If you're familiar with encryption methods, you might have noticed that the POP3 server would need the password for the user in plain text to support APOP. Since PowerMail has 3 password schemas (see Section 9.1), there is a problem. The crypt and md5 method's can NOT be decrypted, and thus can not be used in combination with APOP.
![]() | Only the plain text password schema works with APOP. |
There is still work to be done on many of the Userbases. Authorization of a client is in the Userbase, and APOP relies on that. Not all userbases are suppored, and currently only one is tested.