Migrating crypt scheme with PostfixAdmin, dovecot and roundcube

# time doveadm pw -s ARGON2ID -p secret
{ARGON2ID}$argon2id$v=19$m=65536,t=3,p=1$vOYJ0Sm/nb0i1yPdOo0PaQ$s8q5gCNktv1SX6yZUmkRct5qU34noEQL7Y4G2aVK4cQ

real    0m0.820s
user    0m0.665s
sys     0m0.066s
# time doveadm pw -s ARGON2I -p secret
{ARGON2I}$argon2i$v=19$m=32768,t=4,p=1$B5Kn40XIs0ATDp5yiC7dVw$mA/NWkO1k6hQLXlnuSYhMKbZp7PWYvudtuMjxcUAH74

real    0m0.491s
user    0m0.445s
sys     0m0.043s
# time doveadm pw -s BLF-CRYPT -p secret
{BLF-CRYPT}$2y$05$Qtovd3Uzw6fWk/nIh4OBgeAN2M01p/Us3rP9r1NmQfST.DygLc0hO

real    0m0.053s
user    0m0.034s
sys     0m0.017s
#

# for round in $(seq 4 12); do echo "rounds: ${round}"; time doveadm pw -s BLF-CRYPT -r ${round} -p secret; done
rounds: 4
{BLF-CRYPT}$2y$04$xmaXD0VqFNmRUwq/7.YZLOatMm84DPx9anXOTc5rxUbBNGPEAoEda

real    0m0.048s
user    0m0.034s
sys     0m0.011s
...
rounds: 9
{BLF-CRYPT}$2y$09$V2cF4y2s/nxe0LFQlIMks.fPJUFDaCug8O3lOTmx0lBljlFCiDAYe

real    0m0.098s
user    0m0.083s
sys     0m0.013s
rounds: 10
{BLF-CRYPT}$2y$10$maI6dIPj9/idnQ.m73ZdF.yiFh7/LbIVF3wH00id14cJeN0x6s0AS

real    0m0.148s
user    0m0.129s
sys     0m0.016s
rounds: 11
{BLF-CRYPT}$2y$11$298DxQT9t285KwnsdqNqFOtt1kPR7Ftx15apNXBAUnIEMe1MRGFS2

real    0m0.249s
user    0m0.234s
sys     0m0.012s
rounds: 12
{BLF-CRYPT}$2y$12$y0y8wfk0HgOc.lqKcXXSM.NtfAcWhcaqqyH2hMbUVKg/s5Xa5nGcW

real    0m0.441s
user    0m0.423s
sys     0m0.016s
#

<?php
// php_crypt:CRYPT-METHOD:DIFFICULTY:PREFIX = use PHP built in crypt()-function. Example: php_crypt:SHA512:50000
// - php_crypt CRYPT-METHOD: Supported values are DES, MD5, BLOWFISH, SHA256, SHA512
// - php_crypt DIFFICULTY: Larger value is more secure, but uses more CPU and time for each login.
// - php_crypt DIFFICULTY: Set this according to your CPU processing power.
// - php_crypt DIFFICULTY: Supported values are BLOWFISH:4-31, SHA256:1000-999999999, SHA512:1000-999999999
// - php_crypt DIFFICULTY: leave empty to use default values (BLOWFISH:10, SHA256:5000, SHA512:5000). Example: php_crypt:SHA512
// - php_crypt PREFIX: hash has specified prefix - example: php_crypt:SHA512::{SHA512-CRYPT}
//
// sha512.b64 - {SHA512-CRYPT.B64} (base64 encoded sha512) (no dovecot dependency; should support migration from md5crypt)
//$CONF['encrypt'] = 'BLF-CRYPT';
$CONF['encrypt'] = 'php_crypt:BLOWFISH:11:{BLF-CRYPT}';
?>

$ psql -c "SELECT password FROM admin LIMIT 1" postfixadmin
              password              
------------------------------------
 $1$Q/R19/rg$NR0GDPiZL5wC5qPZqkZXA.
(1 row)

$

for scheme in $(doveadm pw -l); do 
  doveadm pw -s ${scheme} -p secret;
done

postfixadmin=# UPDATE admin   SET password = '{MD5-CRYPT}' || password;
postfixadmin=# UPDATE mailbox SET password = '{MD5-CRYPT}' || password;

 1<?php
 2// See /usr/share/roundcube/plugins/password/config.inc.php.dist for instructions
 3// Check the access right of the file if you put sensitive information in it.
 4$config=array();
 5 
 6// Determine whether current password is required to change password.
 7// Default: false.
 8$config['password_confirm_current'] = true;
 9
10// Enables logging of password changes into logs/password
11$config['password_log'] = false;
12
13// Enables saving the new password even if it matches the old password. Useful
14// for upgrading the stored passwords after the encryption scheme has changed.
15$config['password_force_save'] = true;
16
17// Password hashing/crypting algorithm.
18// Possible options: des-crypt, ext-des-crypt, md5-crypt, blowfish-crypt,
19// sha256-crypt, sha512-crypt, md5, sha, smd5, ssha, ssha256, ssha512, samba, ad
20, dovecot, clear.
21// Also supported are password_hash() algoriths: hash-bcrypt, hash-argon2i, hash
22-argon2id.
23// Default: 'clear' (no hashing)
24// For details see password::hash_password() method.
25$config['password_algorithm'] = 'blowfish-crypt';
26
27// Additional options for password hashing function(s).
28// For password_hash()-based passwords see https://www.php.net/manual/en/function.password-hash.php
29// It can be used to set the Blowfish algorithm cost, e.g. ['cost' => 12]
30$config['password_algorithm_options'] = ['cost' => 11];
31
32// Password prefix (e.g. {CRYPT}, {SHA}) for passwords generated
33// using password_algorithm above. Default: empty.
34$config['password_algorithm_prefix'] = '{BLF-CRYPT}';
35
36// SQL Driver options
37// ------------------
38// PEAR database DSN for performing the query. By default
39// Roundcube DB settings are used.
40// Supported replacement variables:
41// %h - user's IMAP hostname
42// %n - hostname ($_SERVER['SERVER_NAME'])
43// %t - hostname without the first part
44// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
45// %z - IMAP domain (IMAP hostname without the first part)
46$config['password_db_dsn'] = 'pgsql://postfixadmin:the_password_for_the_database@localhost/postfixadmin';
47
48// The SQL query used to change the password.
49// The query can contain the following macros that will be expanded as follows:
50//      %p is replaced with the plaintext new password
51//      %P is replaced with the crypted/hashed new password
52//         according to configured password_algorithm
53//      %o is replaced with the old (current) password
54//      %O is replaced with the crypted/hashed old (current) password
55//         according to configured password_algorithm
56//      %h is replaced with the imap host (from the session info)
57//      %u is replaced with the username (from the session info)
58//      %l is replaced with the local part of the username
59//         (in case the username is an email address)
60//      %d is replaced with the domain part of the username
61//         (in case the username is an email address)
62// Escaping of macros is handled by this module.
63// Default: "SELECT update_passwd(%P, %u)"
64$config['password_query'] = 'UPDATE mailbox SET password = %P, modified = NOW() WHERE username = %u';
65?>

/usr/bin/install -m 750 -g dovecot -o root /dev/null /etc/dovecot/postlogin-updatepw.php

  1#!/usr/bin/env php
  2<?php
  3// PDO dsn
  4$pdo_dsn = 'pgsql:host=localhost;dbname=postfixadmin;user=postfixadm;password=the_password_for_the_database';
  5// $rcmail_config['password_dovecotpw']
  6$dovecotpw = '/usr/bin/doveadm pw -r 11';
  7// $rcmail_config['password_dovecotpw_method']
  8$dovecotpw_method = 'BLF-CRYPT';
  9// where we log
 10$syslog_facility = LOG_MAIL;
 11 
 12// grab what we care about from the env.
 13$username  = getenv("USER");
 14$plainpass = getenv("PLAIN_PASS");
 15 
 16// init syslog.
 17$progname = basename(__FILE__);
 18openlog($progname, LOG_PID, $syslog_facility);
 19 
 20// connect to the database.
 21try {
 22    $dbh = new PDO($pdo_dsn);
 23    $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
 24} catch (PDOException $e) {
 25    syslog(LOG_CRIT, "database connection failed: {$e->getMessage()}");
 26    goto out;
 27}
 28 
 29try {
 30    // retrieve the user's current password.
 31    $sth = $dbh->prepare('SELECT password FROM mailbox WHERE username = ?');
 32    $sth->execute([$username]);
 33    $oldpasswd = $sth->fetchColumn();
 34    if (!$oldpasswd) {
 35        syslog(LOG_WARNING, "unable to find the mailbox for $username");
 36        goto out;
 37    }
 38 
 39    // bail out if the new password is empty.
 40    if (strlen($plainpass) === 0) {
 41        syslog(LOG_ERR, "empty password for $username!");
 42        goto out;
 43    }
 44 
 45    // if we find the dovecot password method in the current password, it does
 46    // not need to be updated.
 47    if (strpos($oldpasswd, $dovecotpw_method) !== false) {
 48        // only during testing syslog(LOG_INFO, "$username already use $dovecotpw_method, skipping.");
 49        goto out;
 50    }
 51 
 52    // generate a new password using `doveadm pw' without passing plainpass
 53    // on the cmdline for security concerns.
 54    $process = proc_open("$dovecotpw -s $dovecotpw_method", [
 55        0 => ['pipe', 'r'],
 56        1 => ['pipe', 'w'],
 57        2 => ['pipe', 'w'],
 58    ], $pipes);
 59    if (!is_resource($process)) {
 60        syslog(LOG_CRIT, "proc_open() failed.");
 61        goto out;
 62    }
 63    // $pipes now looks like this:
 64    // 0 => writeable handle connected to child stdin
 65    // 1 => readable handle connected to child stdout
 66    // 2 => readable handle connected to child stderr
 67    fclose($pipes[2]); // immediately close stderr as we don't need it.
 68    fwrite($pipes[0], "$plainpass\n");
 69    fwrite($pipes[0], "$plainpass\n");
 70    fclose($pipes[0]);
 71    $newpasswd = trim(stream_get_contents($pipes[1]));
 72    fclose($pipes[1]);
 73    $retval = proc_close($process);
 74    if ($retval !== 0) {
 75        syslog(LOG_ERR, "$dovecotpw exited with status $retval, expected 0.");
 76        goto out;
 77    }
 78 
 79    // sanity check to ensure that the new password has been computed with the
 80    // requested method.
 81    if (strpos($newpasswd, $dovecotpw_method) === false) {
 82        syslog(LOG_ERR, "unexpected $dovecotpw output.");
 83        goto out;
 84    }
 85 
 86    // update the password in the database with the newly computed one.
 87    $sth = $dbh->prepare('UPDATE mailbox SET password = :newpasswd, modified = NOW() WHERE username = :username AND password = :oldpasswd');
 88    $success = $sth->execute([
 89        ':newpasswd' => $newpasswd,
 90        ':username'  => $username,
 91        ':oldpasswd' => $oldpasswd,
 92    ]);
 93 
 94    // "close" the database connection,
 95    // see https://secure.php.net/manual/en/pdo.connections.php
 96    $sth = null;
 97    $dbh = null;
 98} catch (PDOException $e) {
 99    syslog(LOG_CRIT, "database query failed: {$e->getMessage()}");
100    goto out;
101}
102 
103if ($success) {
104    syslog(LOG_INFO, "$username password successfully migrated to $dovecotpw_method.");
105} else {
106    syslog(LOG_CRIT, "$username password migration to $dovecotpw_method failed.");
107}
108 
109// FALLTHROUGH
110out: // cleanup.
111 
112// close syslog.
113closelog();
114 
115/*
116 * We have to continue execution from what we get on the command line argument,
117 * i.e. $argv.
118 *
119 * see https://wiki.dovecot.org/PostLoginScripting
120 */
121 
122// $argv[0] is our script (i.e. __FILE__), $argv[1] the next program to
123// execute, and $argv[2..] the next program's arguments.
124$next_exe  = $argv[1];
125$next_argv = array_slice($argv, 2);
126pcntl_exec($next_exe, $next_argv);

postfixadmin=# SELECT username,password,modified FROM mailbox ORDER BY modified
DESC LIMIT 1;

postfixadmin=# SELECT username FROM mailbox WHERE password LIKE '{MD5-CRYPT%';