Subject: Re: Pine and ssh

From: [email-masked] (Jie Yuan)
Date: 21 Apr 1997 11:46:29 GMT

In article <[email-masked]>,
	Peter Karlsson <[email-masked]> writes:
> Is it possible to get Pine to use ssh (secure shell, ueses encryption) 
> instead of rsh to access remote mail folders? I haven't found out how to
> do it.

You should realize that IMAP is not a shell process, therefore ssh has 
nothing to do with it.  To employ encryption schemes in Pine, the IMAP 
server must be hooked to the scheme.  I think Kerbero should be the
answer, and it is probably in the plans of future IMAP, if it is not 
already in operation.

Just my 2c.

Jie
-- Jie Yuan, PhD - U. of Cincinnati - Dept. of Pharmacology & C.B. --
== POBox 670575, Cin., OH 45267-0575 = 513-558-2352 = x-1169 (fax) ==
== www.uc.edu/~yuanj = [email-masked] = using Knews (Irix5.3)     ==
== PGP key: finger -l [email-masked]                      ==

---

From: [email-masked] (Holger Trapp)
Date: 21 Apr 97 12:15:43 GMT

[email-masked] (Jie Yuan) writes:

>nothing to do with it.

Interesting to hear that. Nevertheless I use SSH with Pine every day :-)

There are two ways:

- protect your IMAP stream via SSH's port forwarding mechanism.
  
  I did this for several months and it worked fine. You can find my solution in
  the SSH contrib area, e.g. ftp://ftp.cs.hut.fi/pub/ssh/contrib/imap_sec.tgz. 
  
- use SSH instead of rsh to connect to the remote host and start (a so-called
  pre-authenticated) imapd there. This is the way I've been using pine for
  about a week and I would recommend it because login runs faster and you
  aren't asked for a password by pine. Of course, you must be allowed to start
  a shell on the remote host and you must set a reasonable value for
  "rsh-open-timeout" in .pinerc.

  Unfortunately "rsh" is hardcoded into pine. Therefore I modified the C
  sources a bit. Others replaced rsh by a shell script executing "ssh" when
  being called with the argument "/etc/rimapd". /etc/rimapd is the place where
  pine expects the remote imapd. This is a hardcoded string as well.

  To use ssh instead of rsh you can change the Makefile
  (./pine3.96/imap/non-ANSI/c-client/Makefile or
  ./pine3.96/imap/ANSI/c-client/Makefile repectively).

  In my case I used: 

    RSH=ssh
	RSHPATH=/uni/global/bin/ssh

  To be able to change the RSHPATH and the requested service (/etc/rimapd by
  default) via the environment variables PINE_RSH and PINE_RIMAPD without
  recompiling pine I changed the function tcp_aopen() in
  .../c-client/tcp_unix.c:

  #if 0
        if (user && *user)    /* now run it */
      execl (RSHPATH,RSH,hostname,"-l",user,"exec",service,0);
        execl (RSHPATH,RSH,hostname,"exec",service,0);
  #else
      {
        char *prsh_path, *prsh, *primapd;
  
        if (prsh_path = getenv("PINE_RSH"))
        {
          if (prsh = strrchr(prsh_path, '/'))
          {
            prsh++;
          }
          else
          {
            prsh = prsh_path;
          }
        }
        else
        {
          prsh_path = RSHPATH;
          prsh = RSH;
        }
  
        if (!(primapd = getenv("PINE_RIMAPD")))
        {
          primapd = service;
        }
  
        if (user && *user)    /* now run it */
           execlp (prsh_path,prsh,hostname,"-l",user,"exec",primapd,0);
          execlp (prsh_path,prsh,hostname,"exec",primapd,0);
      }
  #endif

  A better way to change these values would be config options in .pinerc
  but the little hack was much easier to accomplish.

>To employ encryption schemes in Pine, the IMAP server must be hooked to the
>scheme.

Not correct. As shown above you can use SSH absolutely tansparently to imapd.

>I think Kerbero should be the answer, and it is probably in the plans
>of future IMAP, if it is not already in operation.

I don't intend to compare SSH with Kerberos, but Kerberos is not needed in
order to securely access your mail box via IMAP with Pine.

Holger

---

From: Peter Karlsson <[email-masked]>
Date: Mon, 21 Apr 1997 17:09:15 +0200

> You should realize that IMAP is not a shell process, therefore ssh has 

Well, Pine does start up some rsh:s on this end:

 4855   1 S     0:02 pine
 4857   1 S     0:00 rsh bilbo.mdh.se -l dat95pkn exec /etc/rimapd
 4858   1 S     0:00 rsh bilbo.mdh.se -l dat95pkn exec /etc/rimapd

and it was that rsh that I would like to change to ssh. The sshd doesn't
need a shell, afaik.

-- 
\\//
Peter - http://nafmo.home.ml.org/ - ICQ UIN 762719
      - Association Against Big .sigs