Dovecot/Coverting MD5 to SSHA256 passwords

done in dovecot via PostLoginScript, see http://wiki2.dovecot.org/PostLoginScripting and http://wiki2.dovecot.org/HowTo/ConvertPasswordSchemes

add a new field newpw in our database

in conf.d/20-imap.conf:

...

#http://wiki2.dovecot.org/PostLoginScripting
service imap {
  # tell imap to do post-login lookup using a socket called "imap-postlogin"
  executable = imap imap-postlogin
}

# The service name below doesn't actually matter.
service imap-postlogin {
  # all post-login scripts are executed via script-login binary
  executable = script-login /etc/dovecot/loginafter.sh

  # the script process runs as the user specified here (v2.0.14+):
  user = $default_internal_user
  # this UNIX socket listener must use the same name as given to imap executable
  unix_listener imap-postlogin {
  }
}

and in conf.d/20-pop3.conf

# insert these lines so dovecot uses our scripts
service pop3 {
  executable = pop3 pop3-postlogin
}
service pop3-postlogin {
  executable = script-login /etc/dovecot/loginafter.sh
  user = $default_internal_user
  unix_listener pop3-postlogin {
  }
}
# end insert

increase limit or you will get errors

dovecot.conf

default_vsz_limit = 512M

Scripts

/etc/dovecot/loginafter.sh

#!/bin/sh
/etc/dovecot/convertpw.php $USER $PLAIN_PASS
exec "$@"

/etc/dovecot/convertpw.php

#!/usr/bin/php5
<?
#debug file, must exist
$filename = '/tmp/test2.txt';

if (!$handle = fopen($filename, "a")) {
    print "Kann die Datei $filename nicht öffnen";
    exit;
}

$mysqlhost = "localhost";
$mysqluser = "vboxadm";
// username which is used to connect to the database

$mysqlpass = "xxx";
// password which is used to connect to the database

$mysqldb = "vboxadm";
// databasename where the passwords are stored

$mysqltable = "mailboxes";
// table where the passwords are stored

$passfield = "newpw";
// fieldname where the passwords is stored

#user
$usr = explode("@",$argv[1]);
#fwrite($handle, "Checking User ".$argv[1]."\n");

#plain pass
$ruw = $argv[2];

function ssha256($pw) {
        #if(strlen($salt) < 1) {
                $salt = make_salt();
        #}
        return "{SSHA256}" . base64_encode( hash('sha256', $pw . $salt, TRUE ) . $salt );
}

function make_salt() {
        $len   = 4;
        $bytes = array();
        for ($i = 0; $i < $len; $i++ ) {
                $bytes[] = rand(1,255);
        }
        $salt_str = '';
        foreach ($bytes as $b) {
                $salt_str .= pack('C', $b);
        }
        return $salt_str;
}

$link = mysql_connect ("$mysqlhost", "$mysqluser", "$mysqlpass") or die ("Could not connect");
@mysql_select_db("$mysqldb") or die( "Unable to select database");
$result = mysql_query("SELECT $passfield FROM $mysqltable AS m LEFT JOIN domains AS d ON m.domain_id = d.id WHERE m.local_part = '".$usr[
0]."' AND d.name = '$usr[1]' AND $passfield like '{SSHA%'");

#fwrite($handle, "\n".mysql_num_rows($result)."\n");

if (mysql_num_rows($result)==0){
        $newq= "UPDATE $mysqltable,domains SET $mysqltable.$passfield='".ssha256($ruw)."' where $mysqltable.domain_id = domains.id and $m
ysqltable.local_part = '".$usr[0]."' AND domains.name = '".$usr[1]."'"; 
        $res2 = mysql_query($newq);
        fwrite($handle, "SQL: $newq\n");
}
fclose($handle);
 exit; ?>