APOP secrets

I have a client who is using APOP. I recently moved everything to a new server. I went from seeing log lines like this on the old server:

Jan 25 06:22:04 hostname vpopmail[25044]: vchkpw-pop3: (APOP) login success user@domain.com:11.22.33.44

To seeing log lines like this on the new server:

Jan 26 11:36:03 hostname vpopmail[17950]: vchkpw-pop3: password fail user@domain.com:11.22.33.44
Jan 26 11:36:03 hostname vpopmail[17954]: vchkpw-pop3: (PLAIN) login success user@domain.com:11.22.33.44

What can I do about this? I can’t seem to find any place that holds the APOP secrets.

I’ve solved this problem. Apparently during the mass import the pw_clear_passwd entries in the iworx_vpopmail database did not transfer properly. They were just random letters and numbers. The pw_passwd entries all transfered properly. I guess that’s why logins were still working. After changing the pw_clear_passwd entries to the real clear passwords, I started to receive the APOP log lines on the new server. No more failed attempts.

Interesting, thanks for following up Lightfoot. That does actually make sense - the siteworx backups don’t store the “clear” version of the passwords as a security measure. Perhaps we can tweak the process so it “re-learns” the correct password the first time the non-apop authenticates, we’ll look into this.

Paul