POPPASSD(8)

💖 POPPASSD — the manual, but make it make sense 💖

ok so bestie, you found poppassd(8) and honestly? it's giving "small daemon, big responsibilities." let's get into it 🫶

✨ NAME ✨

poppassd — Password change server for Eudora and NUPOP mail clients 🎀

🌸 DESCRIPTION 🌸

so here's the vibe: poppassd runs from inetd and listens on TCP port 106 by default. that's it, that's the whole job. its sole purpose in life — and I mean the way it wakes up every morning with main character energy — is to have little short FTP-like conversations with client applications and then either execute or deny remote password changes via the PAM facilities configured in /etc/pam.d/poppassd. periodt.

the conversation looks something like this:

200 poppassd v1.8.4 hello, who are you?
user adconrad
200 Your password please.
pass foo
200 Your new password please.
newpass bar
200 Password changed, thank-you.
quit
200 Bye.

ok so as you can see from the example above — and bestie I need you to really see it — unencrypted passwords are transmitted over the network. 😭 not it. absolutely not it. no cap.

because of this, it is recommended that you use this daemon only for local loopback password changing (for instance, from Perl, Python, or PHP web applications on the same server) and block all non-local access to port 106, either via tcpwrappers (/etc/hosts.deny) or with appropriate firewall rules. do that. fr fr. 💅

🔥 seriously though — lock that port down. local loopback only unless you know exactly what you're doing.

now. if sending unencrypted passwords over the wire doesn't bug you terribly much (as in the case of an ISP with hundreds of POP3 mail accounts), this daemon can provide a simple way for some of your clients — those running mail clients that actually support this protocol — to easily change their passwords. iykyk. 🌈

🎀 FILES 🎀

• /etc/pam.d/poppassd — contains the PAM configuration for poppassd. by default on Debian, it merely includes the common-auth and common-password files, which should work in most cases. if this doesn't cut it for your site, tailor to suit. slay ✨

🦋 SEE ALSO 🦋

• pam(7)
• inetd(8)
• hosts.deny(5)

👑 AUTHOR 👑

this manual page was written by Adam Conrad <adconrad@0c3.net> for the Debian operating system. iconic behavior honestly 💜

and that's the whole page, bestie — Debian, 19 March 2004, the era of POPPASSD(8) itself. go change some passwords, but keep it on loopback okay?? mwah 💖🎀🌸