initial commitHEADmain

1 files changed, 74 insertions, 0 deletions

diff --git a/wrappers/pam_bloom_doveadm.sh b/wrappers/pam_bloom_doveadm.sh
new file mode 100644
index 0000000..e9a63ef
--- /dev/null
+++ b/wrappers/pam_bloom_doveadm.sh
@@ -0,0 +1,74 @@
+#!/bin/sh
+
+#
+# Wrapper for 'doveadm' tool for creating password hashes for Dovecot.
+#
+# example:
+#
+# using password within rockyou.txt:
+#
+# pam_bloom_doveadm.sh -s ARGON2ID
+# Enter new password:
+# Retype new password:
+# password matches filter: rockyou.txt
+# Password rejected by password policy.
+#
+# using password not in rockyou.txt:
+#
+# pam_bloom_doveadm.sh -s ARGON2ID
+# Enter new password:
+# Retype new password:
+# {ARGON2ID}$argon2id$v=19$m=65536,t=3,p=1$fIS250e9vnNxz.....
+#
+
+prompt_password()
+{
+    prompt=$1
+    printf '%s' "$prompt" >/dev/tty
+
+    stty -echo </dev/tty
+    IFS= read -r REPLY </dev/tty
+    status=$?
+    stty echo </dev/tty
+
+    printf '\n' >/dev/tty
+    return "$status"
+}
+
+prompt_password "Enter new password: " || exit 1
+password=$REPLY
+
+prompt_password "Retype new password: " || exit 1
+password2=$REPLY
+
+if [ "$password" != "$password2" ]; then
+    echo "Passwords do not match." >&2
+    unset password password2 REPLY
+    exit 1
+fi
+
+unset password2 REPLY
+
+printf '%s\n' "$password" | pam_bloom_check
+status=$?
+
+case "$status" in
+    0)
+        ;;
+    1)
+        echo "Password rejected by password policy." >&2
+        unset password
+        exit 1
+        ;;
+    *)
+        echo "Unable to check password policy." >&2
+        unset password
+        exit 2
+        ;;
+esac
+
+printf '%s\n%s\n' "$password" "$password" | doveadm pw "$@"
+status=$?
+
+unset password
+exit "$status"