git://git.josuah.net/passlock - 0.1

PassLock is a backend for checkpassword, a generic and simple password checking interface.

It provides a set of commands to create password entries and check them.

It stores usernames, password and a path with one file per user, with a path pattern of your choice, hashed with argon2id from libsodium.

First create an user:

$ passlock-set -p /etc/paslock/%u ace-ventura
enter passphrase: sekrit

Then test that the password is recognised:

$ printf '%s\0' "ace-ventura" "sekrit" "0" |
  passlock-check \
    -p /etc/paslock/%u \
    -h /var/mail/%u/Maildir \
  echo welcome aboard

Then use it with a checkpassword-enabled daemon:

$ preauth-daemon passlock-check \
    -p /etc/paslock/%u \
    -h /var/mail/%u/Maildir \
  authenticated-daemon

It requires a C compiler and the libsodium library.

$ git clone git://code.z0.is/passlock
$ cd passlock
$ make install PREFIX="$PREFIX" LIBSODIUM="$libsodium"

The main daemon read the password from the user logging in, execute passlock-check and write the password to a pipe (file descriptor 3).

If the password is accurate, passlock-check then execute into its specified program. Otherwise, it exits with an error and nothing more happen.

Processes running during authentication:

preauth-daemon passlock-check -p... authenticated-daemon
└─ passlock-check authenticated-daemon

Processes running after failure:

preauth-daemon passlock-check -p... authenticated-daemon

Processes running after success:

preauth-daemon passlock-check -p... authenticated-daemon
└─ authenticated-daemon

Dovecot can use a checkpassword backend, and passlock works well with it. If your password file is /var/mail/$user/pass owned by mail and your user mailbox is at /var/mail/$user/Maildir:

mail_location = maildir:~/Maildir

service auth {
        user = mail
}

userdb {
        driver = static
        args = uid=mail gid=mail home=/var/mail/%L{username}
}

passdb {
        driver = checkpassword
        args = /usr/bin/env passlock-check -s 10 -h /var/mail/%%u -p /var/mail/%%u/pass
}

You can use %d for domain and %l for local part. Let me know if you have a different way of splitting your user names into directories, maybe non-email-style usernames.