<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><style xmlns="" type="text/css">
div.added { background-color: #ffff99; }
div.deleted { text-decoration: line-through;
background-color: #FF7F7F; }
div.changed { background-color: #99ff99; }
div.off { }
span.added { background-color: #ffff99; }
span.deleted { text-decoration: line-through;
background-color: #FF7F7F; }
span.changed { background-color: #99ff99; }
span.off { }
pre.literallayout {
background-color: #E8E8D0;
padding-left: 0.5cm;
padding-top: 5px;
padding-bottom: 5px;
}
div[class=changed] pre.literallayout {
background-color: #99ff99;
padding-left: 0.5cm;
padding-top: 5px;
padding-bottom: 5px;
}
div.literallayout {
background-color: #E8E8D0;
padding-left: 0.5cm;
padding-top: 5px;
padding-bottom: 5px;
}
div[class=changed] div.literallayout {
background-color: #99ff99;
padding-left: 0.5cm;
padding-top: 5px;
padding-bottom: 5px;
}
</style><title>38. The spa authenticator</title><meta name="generator" content="DocBook XSL Stylesheets V1.72.0" /><link rel="start" href="index.html" title="Specification of the Exim Mail Transfer Agent" /><link rel="up" href="index.html" title="Specification of the Exim Mail Transfer Agent" /><link rel="prev" href="ch37.html" title="37. The dovecot authenticator" /><link rel="next" href="ch39.html" title="39. Encrypted SMTP connections using TLS/SSL" /></head><body><div class="navheader">
<table width="100%" summary="Navigation header"><tr><td width="20%" align="left"><a accesskey="p" href="ch37.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ch39.html">Next</a></td></tr></table></div>
<div class="chapter" lang="en" xml:lang="en">
<div class="titlepage">
<div>
<div>
<h2 class="title"><a href="index.html#toc0291" id="CHAPspa">38. The spa authenticator</a></h2></div>
</div>
</div>
<p>
<a id="IIDspaauth1" class="indexterm"></a>
<a id="IIDspaauth2" class="indexterm"></a>
<a id="id617971" class="indexterm"></a>
<a id="id617986" class="indexterm"></a>
<a id="id618000" class="indexterm"></a>
<a id="id618012" class="indexterm"></a>
The <span><strong class="command">spa</strong></span> authenticator provides client support for Microsoft’s <span class="emphasis"><em>Secure
Password Authentication</em></span> mechanism,
which is also sometimes known as NTLM (NT LanMan). The code for client side of
this authenticator was contributed by Marc Prud’hommeaux, and much of it is
taken from the Samba project (<span class="bold"><strong><a href="http://www.samba.org" target="_top">http://www.samba.org</a></strong></span>). The code for the
server side was subsequently contributed by Tom Kistner. The mechanism works as
follows:
</p>
<div class="itemizedlist">
<ul type="disc"><li><p>
After the AUTH command has been accepted, the client sends an SPA
authentication request based on the user name and optional domain.
</p>
</li><li><p>
The server sends back a challenge.
</p>
</li><li><p>
The client builds a challenge response which makes use of the user’s password
and sends it to the server, which then accepts or rejects it.
</p>
</li></ul></div>
<p>
Encryption is used to protect the password in transit.
</p>
<div class="section" lang="en" xml:lang="en">
<div class="titlepage">
<div>
<div>
<h3 xmlns="" class="title"><a xmlns="http://www.w3.org/1999/xhtml" href="index.html#toc0292" id="SECID179">38.1 Using spa as a server</a></h3></div>
</div>
</div>
<p>
<a id="id618100" class="indexterm"></a>
The <span><strong class="command">spa</strong></span> authenticator has just one server option:
</p>
<p>
<a id="id618128" class="indexterm"></a>
</p>
<div class="informaltable">
<table border="1"><colgroup><col align="left" /><col align="center" /><col align="center" /><col align="right" /></colgroup><tbody><tr><td align="left"><span><strong class="option">server_password</strong></span></td><td align="center">Use: <span class="emphasis"><em>spa</em></span></td><td align="center">Type: <span class="emphasis"><em>string</em></span>†<span class="emphasis"><em></em></span></td><td align="right">Default: <span class="emphasis"><em>unset</em></span></td></tr></tbody></table></div>
<p>
<a id="id618213" class="indexterm"></a>
This option is expanded, and the result must be the cleartext password for the
authenticating user, whose name is at this point in <em class="varname">$auth1</em>. For
compatibility with previous releases of Exim, the user name is also placed in
<em class="varname">$1</em>. However, the use of this variable for this purpose is now deprecated, as
it can lead to confusion in string expansions that also use numeric variables
for other things. For example:
</p>
<pre class="literallayout">spa:
driver = spa
public_name = NTLM
server_password = \
${lookup{$auth1}lsearch{/etc/exim/spa_clearpass}{$value}fail}
</pre><p>
If the expansion is forced to fail, authentication fails. Any other expansion
failure causes a temporary error code to be returned.
</p>
</div>
<div class="section" lang="en" xml:lang="en">
<div class="titlepage">
<div>
<div>
<h3 xmlns="" class="title"><a xmlns="http://www.w3.org/1999/xhtml" href="index.html#toc0293" id="SECID180">38.2 Using spa as a client</a></h3></div>
</div>
</div>
<p>
<a id="id618283" class="indexterm"></a>
The <span><strong class="command">spa</strong></span> authenticator has the following client options:
</p>
<p>
<a id="id618311" class="indexterm"></a>
</p>
<div class="informaltable">
<table border="1"><colgroup><col align="left" /><col align="center" /><col align="center" /><col align="right" /></colgroup><tbody><tr><td align="left"><span><strong class="option">client_domain</strong></span></td><td align="center">Use: <span class="emphasis"><em>spa</em></span></td><td align="center">Type: <span class="emphasis"><em>string</em></span>†<span class="emphasis"><em></em></span></td><td align="right">Default: <span class="emphasis"><em>unset</em></span></td></tr></tbody></table></div>
<p>
This option specifies an optional domain for the authentication.
</p>
<p>
<a id="id618400" class="indexterm"></a>
</p>
<div class="informaltable">
<table border="1"><colgroup><col align="left" /><col align="center" /><col align="center" /><col align="right" /></colgroup><tbody><tr><td align="left"><span><strong class="option">client_password</strong></span></td><td align="center">Use: <span class="emphasis"><em>spa</em></span></td><td align="center">Type: <span class="emphasis"><em>string</em></span>†<span class="emphasis"><em></em></span></td><td align="right">Default: <span class="emphasis"><em>unset</em></span></td></tr></tbody></table></div>
<p>
This option specifies the user’s password, and must be set.
</p>
<p>
<a id="id618489" class="indexterm"></a>
</p>
<div class="informaltable">
<table border="1"><colgroup><col align="left" /><col align="center" /><col align="center" /><col align="right" /></colgroup><tbody><tr><td align="left"><span><strong class="option">client_username</strong></span></td><td align="center">Use: <span class="emphasis"><em>spa</em></span></td><td align="center">Type: <span class="emphasis"><em>string</em></span>†<span class="emphasis"><em></em></span></td><td align="right">Default: <span class="emphasis"><em>unset</em></span></td></tr></tbody></table></div>
<p>
This option specifies the user name, and must be set. Here is an example of a
configuration of this authenticator for use with the mail servers at
<span class="emphasis"><em>msn.com</em></span>:
</p>
<pre class="literallayout">msn:
driver = spa
public_name = MSN
client_username = msn/msn_username
client_password = msn_plaintext_password
client_domain = DOMAIN_OR_UNSET
</pre><p>
<a id="id618593" class="indexterm"></a>
<a id="id618605" class="indexterm"></a>
</p>
</div>
</div>
<div class="navfooter">
<table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ch37.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="ch39.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top"> </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> </td></tr></table></div>
</body></html>
