Format of /usr/local/etc/authlib/userdb

/usr/local/etc/authlib/userdb is a plain text file that can be created using any text editor. Blank lines are ignored. Lines that start with the # character are comments, and are also ignored. Other lines define properties of a single "account", one line per account. /usr/local/etc/authlib/userdb may be a directory instead of a plain file. In that case all files in /usr/local/etc/authlib/userdb are essentially concatenated, and are treated as a single file. Each line takes the following format:

name is the account name. name MUST contain only lowercase characters If Courier is configured to treat lowercase and uppercase account names as identical, name is followed by exactly one tab character, then a list of field/value pairs separated by vertical slashes. field is the name of the field, value is the field value. Fields and values themself cannot contain slashes or control characters. Fields may be specified in any order. Here are all the currently defined fields. Note that not every field is used by every application that reads /usr/local/etc/authlib/userdb.dat.

/usr/local/etc/authlib/userdbshadow.dat

All fields whose name ends with 'pw' will NOT copied to /usr/local/etc/authlib/userdb.dat. These fields will be copied to /usr/local/etc/authlib/userdbshadow.dat. makeuserdb creates /usr/local/etc/authlib/userdbshadow.dat without any group and world permissions. Note that makeuserdb reports an error if /usr/local/etc/authlib/userdb has any group or world permissions.

CONVERTING /etc/passwd and vpopmail to /usr/local/etc/authlib/userdb format

pw2userdb reads the /etc/passwd and /etc/shadow files and converts all entries to the /usr/local/etc/authlib/userdb format, printing the result on standard output. The output of pw2userdb can be saved as /usr/local/etc/authlib/userdb (or as some file in this subdirectory). Linear searches of /etc/passwd can be very slow when you have tens of thousands of accounts. Programs like maildrop always look in /usr/local/etc/authlib/userdb first. By saving the system password file in /usr/local/etc/authlib/userdb it is possible to significantly reduce the amount of time it takes to look up this information.

After saving the output of pw2userdb, you must still run makeuserdb to create /usr/local/etc/authlib/userdb.dat.

vchkpw2userdb converts a vpopmail-style directory hierarchy to the /usr/local/etc/authlib/userdb format. This is an external virtual domain management package that's often used with Qmail servers.

Generally, an account named 'vpopmail' is reserved for this purpose. In that account the file users/vpasswd has the same layout as /etc/passwd, and performs a similar function, except that all userid in users/vpasswd have the same userid. Additionally, the domains subdirectory stores virtual accounts for multiple domains. For example, domains/example.com/vpasswd has the passwd file for the domain example.com. Some systems also have a soft link, domains/default, that points to a domain that's considered a "default" domain.

The vchkpw2userdb reads all this information, and tries to convert it into the /usr/local/etc/authlib/userdb format. The --vpopmailhost option specifies the top level directory, if it is not the home directory of the vpopmail account.

The vchkpw2userdb script prints the results on standard output. If specified, the --todir option tries to convert all vpasswd files one at a time, saving each one individually in dir. For example:

It is still necessary to run makeuserdb, of course, to create the binary database file /usr/local/etc/authlib/userdb.dat

NOTE: You are still required to create the /usr/local/etc/authlib/userdb entry which maps system userids back to accounts, "uid=<TAB>name", if that's applicable. vchkpw2userdb will not do it for you.

NOTE: makeuserdb may complain about duplicate entries, if your "default" entries in users/vpasswd or domains/default/vpasswd are the same as anything in any other /usr/local/etc/authlib/userdb file. It is also likely that you'll end up with duplicate, but distinct, entries for every account in the default domain. For example, if your default domain is example.com, you'll end up with duplicate entries - you'll have entries for both user and user@example.com.

If you intend to maintain the master set of accounts using vchkpw/vpopmail, in order to avoid cleaning this up every time, you might want to consider doing the following: run vchkpw2userdb once, using the --todir option. Then, go into the resulting directory, and replace one of the redundant files with a soft link to /dev/null. This allows you to run vchkpw2userdb without having to go in and cleaning up again, afterwards.