Subject: Help setting up imap

From: "Richard G. Roberto" <[email-masked]>
Date: Fri, 14 Jun 1996 08:59:23 -0400 (EDT)

Hi,

Sorry I'm sending you this directly and cc-ing the list, but main to the
list keeps bouncing for me (probably this cc as well!)  I can't seem to
access the imap web page.  I know it works because I sent another mail
about this before and all responses said it was fine.  I get the list and
recieved instructions on how to set up pine to be an imap client without
having to enter a username and passwd, etc.  I linked /usr/local/etc/imapd
to /etc/rimapd and put a + in my ~/.rhosts file.  My username/UID/GID on
my home machine are identicle to work and rsh workmachine /etc/rimapd
works as you described in previous mail.  "A01 logout" works fine as well.
However, pine (3.91 for linux) still prompts me for a username and passwd.
I can't find settings to augment this behavior in the rc file, so I grab
3.94 and drop it in.  It compiles fine (a few errors I didn't unerstand,
but the build completed.  I think it was looking for "bfd" something or
other -- a hard coded path for something I don't have installed?).
Anyway, now I'm running 3.94.  The enable-mouse-in-xterm setting does very
strange things.  No big deal, I can do without that (although I'd like to
get it working).  This big deal is, now I get prompted for a passwd when
pine just starts up -- before I only got prompted when I tried to access a
folder collection on the imap server machine.  Not only that, but I get
prompted for a passwd again when I try to access my work incoming folder
collection, and then again when I try to access my work saved folder
collection!  Perhaps the first authentication is for the SMTP server
setting and the others are correct?  The SMTP server is set to the same
machine my imap collections are on.  If this is the correct behavior, I
_really_ need to get this PREAUTH stuff working.  Any Ideas?  By the way,
my work machine is a SPARC4 runnning Solaris2.5 and the imap daemon from
the 3.93 pine dist.

TIA

P.S.: Any chance of "imap" being changed to "impa"?  I keep misspelling
it!!!  Either that or I'll have to learn to type!!!

Richard G. Roberto
[email-masked]
201-739-2886 - whippany, nj

--
*******************************************************************************
Bear Stearns is not responsible for any recommendation, solicitation, offer or
agreement or any information about any transaction, customer account or account
activity contained in this communication.
*******************************************************************************

---

From: "Richard G. Roberto" <[email-masked]>
Date: Fri, 14 Jun 1996 11:30:48 -0400 (EDT)

On Fri, 14 Jun 1996, Mike Brudenell wrote:

> AAAAARRRGGGHHHH!!!
> 
> 			URGENT!!  URGENT!!  URGENT!!
> 
> I think you may have just opened a gaping great security whole onto your
> computer and proudlu announced the fact to the world!
> 
> If you read the man page ".rhosts" it says that entries in your .rhosts
> file should be the "official" fully-qualified name of a host.  It then
> goes on to say...

We don't run DNS, so "fully qualified" is just the hostname.  This is
another little peeve of mine, as of 3.93, Pine barks about that!  Any way
to shut that off?  My work machine is _NOT_ attached to the internet.  We
batch our outgoing mail through another network (of HP/UX machines) and
from there to MCI, and then to the internet.  There are Checkpint
firewalls at least 6 deep between me and the outgoing spool.  My netscape
access is secure and triple proxied (me<->F1<->F2<->F3<->internet).  All
of this is fortified with SeOS as well.  I'm not saying that even this is
bullet proof, but we have whole departments dedicated to assuring security
here. If someone can get through all of that, my silly little .rhosts file
is surely not our biggest problem.

> 
> 	However, a hostname consisting of a single `+' indicates that all
> 	known hosts are to be trusted.  (Sites connected to external
> 	networks such as the Internet should not use `+'.) 
> 
> If I'm correct you have just opened your username to any computer on the
> Internet (providing the person has the same username as you).

Wrong.  They need to have the same identity as me (ie. UID/name/GID?) and
the source host needs to be well known to my system.  Since we don't run
DNS, this is a pretty tough spoof.  We also run secure RPC.

> 
> I suggest you check and change this pronto!

Already done.  I only used the "+" for testing last night.

> 
> 
> As for your authentication question....
> 
> Given your comment about error/warning messages when you were compiling
> Pine I'd suggest you try pulling the already compiled executable version
> of Pine instead and trying that.  You can get it from:
> 
> 	ftp://ftp.cac.washington.edu/pine/unix-bin/pine-bin.linux
> 

I'll try this tonight.

> Make sure you transfer it in binary mode, then just rename the resulting
> file from "pine-bin.linux" to "pine".
> 
> If this doesn't work either....
> 
> There really isn't anything magical about what Pine does when trying to
> pre-authenticate.  It extracts the hostname from the folder configuration
> line (in your .pinerc file) and then executes the command:
> 
> 	rsh that.host.name /etc/rimapd
> 
> It then checks that the connection was made and a response indicating that
> a pre-authenticated connection was made.  If you can see this by typing
> the above command to the UNIX command line prompt then I would really
> expect Pine to be able to pre-authenticate OK.
> 
> Can you send me a copy of your .pinerc file?  You can do this by putting
> the cursor on the "Attchmnt:" header and typing in the name of the file
> (.pinerc).  If all goes well it will expand this to the full filename and
> put the size of the file after it.

I'll send it tonight.

> 
> 
> Finally, your thoughts about sendmail are a red herring... you do not need
> to authenticate to sendmail.  Therefore the requests for you to
> authenticate are definitely coming from the IMAP connection.
> 

My SMTP server setting is another machine -- my imap server machine.  Does
my local sendmail just forward everything pine sends to it? What exactly
does this setting do?  I was under the impression that setting this to
another machine told pine to bypass the local SMTP agent (sendmail) and
talk SMTP directly to the host set in the variable.  Obviously I was
wrong, but could you clarify this mechanism?

> Cheers,
> 
> Mike Brudenell                                         <[email-masked]>

TIA

Richard G. Roberto
[email-masked]