Subject: Re: remote mail server

From: [email-masked] (Kathleen M. Foresti)
Date: 2 Jun 1995 12:04:24 GMT

I'd be interested too.

Article: 8848 of comp.mail.pine
Path: newstand.syr.edu!transit.nyser.net!news.sprintlink.net!news.bluesky.net!news.mathworks.com!uunet!news.LASER.NET!usenet
From: [email-masked]
Newsgroups: comp.mail.pine
Subject: remote mail server
Date: Wed, 31 May 95 14:39:40 PDT
Organization: LaserNet, L.L.C.
Lines: 19
Message-ID: <[email-masked]>
NNTP-Posting-Host: support.laser.net
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Newsreader: NEWTNews & Chameleon -- TCP/IP for MS Windows from NetManage

I currently have 7  BSDI boxes.  Is it possible to forward all mail to a new 
(8th) machine 
and have all my users get mail from that machine without logging into it?

I am using Pine 3.91 and BSDI v2.0

I want to avoid the following:
	1. users logging into the mail server.
	2. entering users into the new machine
	3. letting the users know the machine is there.

Thanks

Rick Bill
[email-masked]

-- 
********************************************************************
Kathie Foresti                    email:    [email-masked]
Computing & Media Services        phone:    (315) 443-4103
212 Machinery Hall                fax:      (315) 443-3817
Syracuse University               Syracuse, NY 13244-1260
********************************************************************

---

From: [email-masked] (Trey Harris)
Date: 4 Jun 1995 04:33:54 GMT

>and have all my users get mail from that machine without logging into it?

Yep.  Not that hard.

>I am using Pine 3.91 and BSDI v2.0

Good. That gives you two options, assumng you don't have users who are 
using other MUAs than Pine.

>	1. users logging into the mail server.

No problem.  Are all your users using Pine?  Then your easiest and best 
course by far is to run IMAP.

What you do is your set your sendmail.cfs on all seven user machines so 
that they accept mail from anywhere and just send it on to the eighth 
machine.  This is easy if you're handy with sendmail.cf files, but I'm 
not going to tell you how to do it because it would increase the length 
of this message by about 300%.  Get O'Reilly's _Sendmail_ by Costales, 
Allman and Rickert if you need to learn how.

The eighth machine needs to accept mail from any of the other machines as 
mail for local delivery.  This, too, is a simple sendmail.cf hack. Make 
sure that usernames on the seven machines are all the same for the same 
people, and then put an /etc/passwd on the eighth machine containing all 
those mail users' usernames.  Periodically grab their /etc/passwd and/or
/etc/shadow entries so that the users' passwords are the same both on 
their login machine(s) and the mail server.  Or, if you're running NIS, 
make the mail server part of your NIS domain with the proper privileges 
to be able to read the password map.

Here's where the two options come in.  If you're not running Pine
exclusively, you'll need to export /var/spool/mail on the mail server to
the other seven machines via NFS, and hard mount them on all the other
machines' /var/spool/mail directories.  Don't allow interrupts, and don't
soft mount; if you do, you're asking for mailbox corruption.  You didn't
say whether the same user base exists on each of the seven login hosts. 
If you're not using NIS, make sure that the UID number for a given user is
the same on all eight hosts; otherwise mailbox ownership over NFS will be
corrupt. 

Even with non-interruptable hard mounts, NFS mounting of /var/spool/mail
is still a dangerous thing.  That's why, if you are exclusively using 
Pine, IMAP is a better option.  Compile and install imapd on the mail 
server; make the necessary entries in /etc/services and /etc/inetd.conf.  
Place a link to the location in which you have installed imapd to 
/etc/rimapd.  Then in the /etc/hosts.equiv file on the mail server, list 
all the other seven hosts.  This is a possible security hole; make sure 
that you are comfortable with the security of the physical network on 
which the eight machines reside and with the security of the other seven 
hosts before you do this.

Now, create a pine.conf.fixed file on each of the seven login hosts
with the entry:

inbox-path={mail.server.name}INBOX

where you substitute the name of the mail server for mail.server.name 
above.

Now, if everything worked correctly, your users will start Pine, read 
their email, and never realize that anything has changed (assuming you 
migrated your users' mailboxes to the mail server machine when you did 
all this).

>	2. entering users into the new machine

Do you mean without adding your users to the /etc/passwd of the mail 
server?  Sorry; you'll have to do that.  I can think of one or two ways 
to do it using obscure sendmail delivery options so that you don't have 
to have all users in /etc/passwd, but it isn't at all worth it, because 
sendmail's security is largely based on the sanctity of users and usernames.

If you didn't, for instance, add <rmbill> to the mail server, how would 
sendmail know whether to accept or reject mail addressed to <rmbill>?  
You see now why you must add all users to a machine in order to allow 
them to receive mail there.

Of course, if you're using NIS, this can become easier (it sounds like 
you may have a small enough installation to where NIS wouldn't be a bad 
thing necessarily).

>	3. letting the users know the machine is there.

Again, I'm not sure what you mean with this.  If you mean, "without 
making the users change things in their setups", then you've done that 
with the pine.conf.fixed file change above; they won't have to do 
anything.  If, on the other hand, your intent is to not let them see the 
machine on the network--I think you're out of luck.  That's not very 
important though, IMHO; usually users ignore machines that they don't 
know the purpose of, unless they have cracking in mind.

If you want to *keep* users from being able to log into the mail server 
even if they try, you'll need to set their shell on the eighth machine to 
be something that doesn't allow login but that will allow /etc/rimapd to 
be run.  You can write one yourself, but the Pine development group have 
a good one called imapsh, which I believe is on their FTP server at 
ftp://ftp.cac.washington.edu.  If it isn't, it should be. :) I can send 
it to you if you don't find it.

Add it to /etc/shells, or users won't be able to run rsh on the machine, 
which is the point in the fake shell in the first place. :)

Hope all this helps.
-- 
Trey Harris                              http://sunsite.unc.edu/harris
  System Administrator, Project Isis, Office of Information Technology
                       The University of North Carolina at Chapel Hill