Password hashing
Fully supported hashing methods¶
The most current mailcow fully supports the following hashing methods. The default hashing method is written in bold:
- BLF-CRYPT
- SSHA
- SSHA256
- SSHA512
The methods above can be used in mailcow.conf as MAILCOW_PASS_SCHEME value.
Read-only hashing methods¶
The following methods are supported read only. If you plan to use SOGo (as per default), you need a SOGo compatible hashing method. Please see the note at the bottom of this page how to update the view if necessary. With SOGo disabled, all hashing methods below will be able to be read by mailcow and Dovecot.
- ARGON2I (SOGo compatible)
- ARGON2ID (SOGo compatible)
- CLEAR
- CLEARTEXT
- CRYPT (SOGo compatible)
- DES-CRYPT
- LDAP-MD5 (SOGo compatible)
- MD5 (SOGo compatible)
- MD5-CRYPT (SOGo compatible)
- PBKDF2 (SOGo compatible)
- PLAIN (SOGo compatible)
- PLAIN-MD4
- PLAIN-MD5
- PLAIN-TRUNC
- SHA (SOGo compatible)
- SHA1 (SOGo compatible)
- SHA256 (SOGo compatible)
- SHA256-CRYPT (SOGo compatible)
- SHA512 (SOGo compatible)
- SHA512-CRYPT (SOGo compatible)
- SMD5 (SOGo compatible)
That means mailcow is able to verify users with a hash like {MD5}1a1dc91c907325c69271ddf0c944bc72 from the database.
The value of MAILCOW_PASS_SCHEME will always be used to encrypt new passwords.
I changed the password hashes in the "mailbox" SQL table and cannot login.
A "view" needs to be updated. You can trigger this by restarting sogo-mailcow: docker compose restart sogo-mailcow