Name¶

authmgr — Demultiplexer for authentication requests

Description¶

authmgr is a component that, for mail account authentication, dynamically selects the authentication backend per user account.

Configuration directives¶

The following directives are recognized when they are in /etc/gromox/gromox.cfg:

auth_fail_delay

The amount of time to wait after a failed authentication attempt (unknown user or rejected password). When the MySQL database itself is unavailable, the delay is also added, which mitigates a little what could otherwise be an authentication storm. Users which are externally managed (e.g. in LDAP) are exempt from auth_fail_delay in Gromox, since the expectation is that the LDAP Bind operation already inserts a delay of its own. Setting the value to 0 disables the delay. Per-username banning by user_filter(4gx) applies regardless of this setting. Subsecond resolution is available.
Default: 1s

auth_backend_selection

This controls how authmgr will verify passwords supplied with login operations. See the "Authentication modes" section below for details.
Available: deny_all, allow_all, ldap, pam
Default: ldap

Authentication modes¶

• deny_all: every attempt at authentication is rejected. This is at best useful for testing. This also implies auth_fail_delay=0.
• allow_all: every attempt at authentication (provided the user exists) is permitted. This may be handy when doing the initial mass-import of mailboxes via external IMAP-to-IMAP synchronization utilities such as imapsync without needing to know user passwords.
• ldap (old name: externid): authmgr will selectively pick LDAP/MySQL, depending on whether the externid column in the user database has a value or contains just the empty string. The particular value is ignored and only meaningful to the importer.
• pam: authmgr will selectively pick PAM/MySQL. The PAM service name will be "gromox". Be sure that pam_gromox.so is not invoked as part of that PAM service stack, or it will lead to infinite recursion.

Signals¶

Upon receipt of SIGHUP, configuration files are re-read, but only a few select directives can be changed this way, as many parts do not implement reload.

See also¶

gromox(7), ldap_adaptor(4gx), mysql_adaptor(4gx)