Activesync session password

Hi

Had/Have the same problem for a while, posted already on that list, but no luck till now and no time to search the reason, so ty for this hint.

Rgds

Hm,
looks like a feature, not a bug.
Because no one is interested in.

Rgds

Hi.

Think, i found the cause in egw.

When u create a new user and set up his mail as admin, then it will be encrypted with the egw hash so, database -> egw_ea_credentials -> cred_pw_enc -> 4

When you are logged is as user and try to edit your mailaccount, that the admin creates, database -> egw_ea_credentials -> cred_pw_enc changes to 3, encrypted with user hash.

Try in this case, you needn’t to change something, only open the edit popup and -> Save changes the value.

Solution: delete this mailaccount as admin and create it again, as admin, so that the pw is encrypted with the egw hash.

The “error” (message) is a hand made error and it doesn’t work with database -> egw_ea_credentials -> cred_pw_enc -> 3, it breaks, when this value is set.

I’m right with this?

Rgds.

Hi.

A Quote (api/src/Mail/Credentials.php):
/**

	 * Password in cleartext

	 */

	const CLEARTEXT = 0;

	/**

	 * Password encrypted with user password

	 *

	 * MCrypt algo 'tripledes' and mode 'ecb' or OpenSSL 'des-ede3'

	 * Key is direct user password, key-size 24 (truncated to 23 byte, if greater then 24 byte!)

	 */

	const USER = 1;

	/**

	 * Password encrypted with system secret

	 *

	 * MCrypt algo 'tripledes' and mode 'ecb' or OpenSSL 'des-ede3'

	 * Key is direct system secret, key-size 24 (truncated to 23 byte, if greater then 24 byte!)

	 */

	const SYSTEM = 2;

	/**

	 * Password encrypted with user password

	 *

	 * OpenSSL: AES-128-CBC, with key generated via hash_pbkdf2 sha256 hash and 12 byte binary salt (=16 char base64)

	 */

	const USER_AES = 3;

	/**

	 * Password encrypted with system secret

	 *

	 * OpenSSL: AES-128-CBC, with key generated via hash_pbkdf2 sha256 hash and 12 byte binary salt (=16 char base64)

	 */

	const SYSTEM_AES = 4;

It’s a session thing, but not as you think, because it works, when database -> egw_ea_credentials -> cred_pw_enc -> 4 -> SYSTEM_AES
and it does not work with database -> egw_ea_credentials -> cred_pw_enc -> 3 -> USER_AES
I’ve tried it with a clean egw installation, with only 1 additional user and tested it (changing cred_pw_enc by edit mailaccounts).
And have a “production” system, where i have users where it works -> when i create the mailaccount by admin -> cred_pw_enc -> 4,
it not works -> when the user edit his profile by himselfe cred_pw_enc -> 3.

So i think, that the encryption with userpassword does not work, because the userpassword is not used to decrypt or create a session.

Or does it work in your system?

Rgds.

Hi.

Sry, it isn’t the full mail, i try to edit it.

Edit: done

You said: "We create the mail-accounts encrypted with the user password to store the mail password as secure as possible!"
But it is only given with USER_AES = 3;, not 4
and 4 is created, when the admin creates the mail account settings and in this case, sync does work.

Rgds.

Hi.

Ok, another question:
What is the difference between creating a session encrypted by system and by user?

RalfBecker EGroupware GmbH
January 25
If admin creates an account, we can not use the user password, as admin does not know it, so we use the system secret instead, but that is less secure (evil admin could eg. read other peoples mail).

Anyway your problem is that you loose the session and with the session the password!

---

Visit Topic or reply to this email to respond.

---

Previous Replies

Beliebig-2
January 25
Hi.

Sry, it isn’t the full mail, i try to edit it.

Edit: done

You said: "We create the mail-accounts encrypted with the user password to store the mail password as secure as possible!"
But it is only given with USER_AES = 3;, not 4
and 4 is created, when the admin creates the mail account settings and in this case, sync does work.

Rgds.

RalfBecker EGroupware GmbH
January 25
What do you want to say with that quote?

Beliebig-2
January 25
Hi.

A Quote (api/src/Mail/Credentials.php):
/**

>  * Password in cleartext */ const CLEARTEXT = 0; /** * Password encrypted with user password * * MCrypt algo 'tripledes' and mode 'ecb' or OpenSSL 'des-ede3' * Key is direct user password, key-size 24 (truncated to 23 byte, if greater then 24 byte!) */ const USER = 1; /** * Password encrypted with system secret * * MCrypt algo 'tripledes' and mode 'ecb' or OpenSSL 'des-ede3' * Key is direct system secret, key-size 24 (truncated to 23 byte, if greater then 24 byte!) */ const SYSTEM = 2; /** * Password encrypted with user password * * OpenSSL: AES-128-CBC, with key generated via hash_pbkdf2 sha256 hash and 12 byte binary salt (=16 char base64) */ const USER_AES = 3; /** * Password encrypted with system secret * * OpenSSL: AES-128-CBC, with key generated via hash_pbkdf2 sha256 hash and 12 byte binary salt (=16 char base64) */ const SYSTEM_AES = 4;