There are circumstances when you must check if the known user account passwords are the ones actually stored in hMailServer.
The hMailServer default configuration doesn’t allow this kind of check because stores account passwords as SHA-256 salted hashes for security reasons, from which you can’t get the original clear text passwords anymore.
The algorithm used by hMailServer to obtain the SHA-256 salted hash from a user account password is reported in previous topics as
http://www.hmailserver.com/forum/viewtopic.php?f=7&t=16658&p=97515.
In the following I propose a simple Access VBA function, which uses a class for generating the SHA-256 signature of a string developed by Phil Fresle and downloadable at
http://www.frez.co.uk/SHA.zip.
Code:
' Procedure: AccPwdControl
' Version: 1.0
' Date: 5/14/2010
' Purpose: Verifies if clear text password and encrypted password match
' Arguments: strClearPwd - user account clear text password
' strSha256Pwd - user account encrypted password
' Returns: 0 - passwords match
' 1 - encrypted password length error
' 2 - clear text password empty error
' 3 - passwords mismatch
' Requisites: Phil Fresle's CSHA256 class
Function AccPwdControl(ByVal strClearPwd As String, _
ByVal strSha256Pwd As String) As Integer
Const HASH_LENGTH As Integer = 64 ' SHA256 hash length
Const SALT_LENGTH As Integer = 6 ' HMailServer salt length
Const ENCR_PWD_LENGTH As Integer = HASH_LENGTH + SALT_LENGTH ' Encrypted password length
Dim objSha256 As New CSHA256
Dim strSalt As String
Dim strEncPwd As String
Dim intErrCode As Integer
' Inizializes error code
intErrCode = 0
' Extracts Salt from encrypted password
strSha256Pwd = Trim(strSha256Pwd)
If Len(strSha256Pwd) = ENCR_PWD_LENGTH Then
strSalt = Left(strSha256Pwd, SALT_LENGTH)
Else
intErrCode = 1
End If
' Generates SHA256 hash for clear text password
If intErrCode = 0 Then
strClearPwd = Trim(strClearPwd)
If Len(strClearPwd) > 0 Then
strEncPwd = objSha256.SHA256(strSalt & strClearPwd)
strEncPwd = strSalt & strEncPwd
Else
intErrCode = 2
End If
End If
' Compares SHA256 hash with encrypted password
If intErrCode = 0 Then
If strSha256Pwd <> strEncPwd Then intErrCode = 3
End If
' Ends function
Set objSha256 = Nothing
AccPwdControl = intErrCode
End Function
The function allows to check the correspondence between a clear text password and the SHA-256 hash stored in hMailServer and can be used also into a SQL query to carry out controls over data stored in Access tables.
Before using the function you must import in VBA Editor (File --> Import file) the class module CSHA256.cls content into SHA.zip.
The attached MS Access 2007 file includes:
the module with AccPwdControl function (basAccPwdControl);
the CSHA256 class module;
a form that demonstrates the AccPwdControl function use (frmPwdControl);
an example table with clear text passwords and encrypted passwords of some accounts (tblPasswords);
a query that uses the AccPwdControl function for verifying passwords in tblAccounts (qryPwrdControl).
Login
Register
FAQ
Search
