Subject: Pine tries to create INBOX on IMAP server?

From: Michael Driscoll <[email-masked]>
Date: Wed, 22 Jul 1998 13:24:07 -0600

Hello all, I've been having trouble using PINE with the IMAP4r1 server I'm
writing, and am unsure whether the fault lies with PINE or my understanding
of RFC2060 (probably the latter).

Anyways, here's the rundown.  I've only implemented about half of the
IMAP4rev1 features, but I figured it would be enough to test basic
operations with a clients (logging in, mailbox listing, etc).

So I compiled and installed PINE and tried to set it up for use with
my IMAP server.  However, I tried to (in PINE) save the collection I
had entered and PINE contacted the server and issued these commands
(taken from my log):

Jul 22 11:58:44 ulfheim in.rshd[11892]: connect from localhost
Jul 22 12:58:44 ulfheim imapd[11893]: normal read: [00000000 CAPABILITY]
Jul 22 12:58:44 ulfheim imapd[11893]: normal read: [00000001 LOGIN test test]
Jul 22 12:58:44 ulfheim imapd[11893]: normal read: [00000002 LIST "" ""]
Jul 22 12:58:44 ulfheim imapd[11893]: normal read: [00000003 LOGOUT]
Jul 22 11:58:46 ulfheim in.rshd[11900]: connect from localhost
Jul 22 12:58:46 ulfheim imapd[11901]: normal read: [00000000 CAPABILITY]
Jul 22 12:58:46 ulfheim imapd[11901]: normal read: [00000001 LOGIN test test]
Jul 22 12:58:46 ulfheim imapd[11901]: normal read: [00000002 Create INBOX]
Jul 22 12:58:46 ulfheim imapd[11901]: normal read: [00000003 LOGOUT]

The command that I'm having trouble with is that second to last one,
"Create INBOX".  According to RFC2060, 6.3.3:

      ...  It is an error to attempt to create INBOX or a mailbox
      with a name that refers to an extant mailbox.  Any error in
      creation will return a tagged NO response.

So my server generates "<tag> NO Tried to create INBOX" and PINE
seems to take that as a fatal error and refuses to save my collection
(The dialog "Tried to create INBOX" appears at the bottom of PINE's
window, and I am left at the "Create new collection" screen).

Here's what the client/server dialog actually looks like, simulated by
telnet:

S: * OK IMAP4rev1 Service Ready [Foomail 5.4.1]
C: 00000000 CAPABILITY
S: * CAPABILITY IMAP4rev1
S: 00000000 OK Capability completed
C: 00000001 LOGIN test test
S: 00000001 OK User test logged in
C: 00000002 LIST "" ""
S: * LIST () "/" ""
S: 00000002 OK List completed
C: 00000003 LOGOUT
S: * BYE Performing logout
S: 00000003 OK Logout completed

<PINE reconnects>

S: * OK IMAP4rev1 Service Ready [Foomail 5.4.1]
C: 00000000 CAPABILITY
S: * CAPABILITY IMAP4rev1
S: 00000000 OK Capability completed
C: 00000001 LOGIN test test
S: 00000001 OK User test logged in
C: 00000002 Create INBOX			<=== Here is the line
S: 00000002 NO Tried to create INBOX
C: 00000003 LOGOUT
S: * BYE Performing logout
S: 00000003 OK Logout completed

So, does anyone have any idea what is going on, and how I can remain
true to RFC2060 and have PINE work with my server at the same time?

By the way, this is PINE 4.00 with LDAP support newly compiled on
a Linux glibc-2 box.

Thanks for your time,
		Michael Driscoll

-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: PINE list <[email-masked]>
Date: Thu, 23 Jul 1998 01:23:12 +0300 (EEST)

When doing su - myuser from root and I want to read my mail it
says sometimes...
                             [>UID sequence invalid<]

but it ins't a critical one... bug I mean...

---

From: SuperVisor de PINE <[email-masked]>
Date: Fri, 24 Jul 1998 18:44:53 -0600 (GMT-0600)

Hello, I'm volunteer tester of PINE software into two systems: AIX4.1/3.2
and NeXTstep 3.0 and I still see some extrange messages refering to
Mailbox vulnerability just on AIX4.1 like this:

Mailbox vulnerable - error creating /var/spool/mail/august.lock.901321877.1898

I'm still trying to figure it out, 'cause on AIX3.2 and NeXTstep 3.0 PINE
software run fine, so I hope suggestions of what to do... thanx and keep
feeding this incredible mailbox listing...

Regards from Colima, MEXICO.

Augusto A. Guerrero Rodriguez.

---

From: Peter Green <[email-masked]>
Date: Fri, 24 Jul 1998 20:20:26 -0500 (CDT)

> Mailbox vulnerable - error creating /var/spool/mail/august.lock.901321877.1898

I use pine 4.02 on AIX 4.2.1 and I haven't seen these messages. However, I
*have* seen them on (at least) pine 4.00 on a RedHat 5.1 machine. Could it
be a permissions thing or a different locking mechanism or what?

/pg

---

From: Bruno <[email-masked]>
Date: Fri, 24 Jul 1998 22:07:52 -0700 (PDT)

> be a permissions thing or a different locking mechanism or what?

Pine is trying to write its .lock files to /var/spool/mail/, yet its
running as the uid executing it (august), whom probably does not have
write permissions to /var/spool/mail/.

The solution, make pine setgid to the mail group or chmod /var/spool/mail/
to 1777, world writable with a sticky bit so files can only be deleted by
respective owners or UID 0.

This is all in the release notes/technical documentation of pine 4.x.

____________________________________________

 Bruno                      [email-masked]
____________________________________________

---

From: Matthew Kelly <[email-masked]>
Date: Sat, 25 Jul 1998 06:43:17 -0400 (EDT)

Bruno:

If you make pine sgid mail you have likely given everyone the ability to
read each others' mail, or at least the ability to delete it. To stop them
from being able to delete each other's mail, you'd need to add the sticky
bit to the spool directory. In which case you are back to fixing the
problem the other way.  The real fix is 01777 for your mail spool
directory.

Matt

On Fri, 24 Jul 1998, Bruno wrote:

> Date: Fri, 24 Jul 1998 22:07:52 -0700 (PDT)
> From: Bruno <[email-masked]>
> To: Pine Discussion Forum <[email-masked]>
> Subject: Re: Still Mailbox vulnerability on PINE4.01...
> 

-- 
-------------------------------------------------------------------------
Matthew Kelly
[email-masked]

---

From: Greg Sutherland <[email-masked]>
Date: Mon, 27 Jul 1998 08:56:43 -0400 (EDT)

I'm seeing the problem with pine 4.02 on AIX4.2.1.  I've looked at all the
permissions I could think of.  I don't have the problem with pine 3.96 on
the same box.  If anyone has solved this problem please let us know.
         
       ||||When|responding,|please|include|enough|of|the|contents|of||||
       ||                                                             ||
       ||   Greg Sutherland              Mail  [email-masked]   ||
       ||   Systems Administrator       Phone  706/721-3849           ||
       ||   Medical College of Georgia    Fax  706/721-7634           ||
       ||                                                             ||
       |||the|original|note|so|that|I|know|what|you|are|responding|to|||

---

From: Brock Rozen <[email-masked]>
Date: Mon, 27 Jul 1998 19:12:21 +0300 (IDT)

But now Pine is complaining (after I fixed that) about my /home directory.

Non-permanent unique identifiers.

-- 

   ----------------------------------
   | Brock Rozen | [email-masked] |
   ----------------------------------

---

From: Bruno <[email-masked]>
Date: Mon, 27 Jul 1998 09:07:12 -0700 (PDT)

> the same box.  If anyone has solved this problem please let us know.

chmod 1777 /var/mail

 Bruno                      [email-masked]

---

From: Greg Sutherland <[email-masked]>
Date: Mon, 27 Jul 1998 14:19:38 -0400 (EDT)

Bruno, Thanks for the response.  I set /var/spool/mail to 1777 which took
care of the error message.  I notice that it also opens up /var/spool/mail
for temporary storage for anyone who wants to use it and it makes
it possible for someone to distroy their own inbox.  I don't see these
as serious problems, but I wonder what serious problems were in pine3.96
that make this a better way?

greg

---

From: Bruno <[email-masked]>
Date: Mon, 27 Jul 1998 11:42:40 -0700 (PDT)

> that make this a better way?

This problem was still there in Pine 3.96, pine just didn't display the
error message until 4.x :)  So, the main reason to implement the mode
change on /var/mail/ would be to get rid of this error message.  The
locking shouldn't be too catastrophic given if a user is reading their
e-mail in pine, they would presumably not be using pop at the same time or
using simultaneous (and multiple) occurences of pine.

As far as the 1777 setting on your mail spool directory..  Users should
have been able to delete their own inbox before since their mailbox is
owned and writable by them.  Yes, this does open up /var/mail/ for temp
storage, but this isn't the end of the world.  We're running nightly crons
that not only make sure proper permissions are set on all of the spool
files, but it also deletes any spool files that do not have a
corresponding user entry in the passwwd [file|table].

Good luck.  :)

 Bruno                      [email-masked]

---

From: "haenni andre" <[email-masked]>
Date: Tue, 28 Jul 1998 09:16:35 +0200 (CUT)

I just checked this feature, as I'm still running pine 3.96 on my site.

OK, pine 3.96 doesn't lock the inbox, but this isn't a problem, really,
because pine 3.96 DOES check inbox access, using some sort of virtual
locking. As soon as a new process tries to open inbox, pine writes
back the latest changes, hands its virtual locking over to the newly
started process, and sets the old session read-only.

The following message appears on the old session:
[Another Pine is accessing Inbox.  Session now Read-Only.]

In fact, for people logging in from another terminal this is quite a
useful feature, as it eliminates the need to kill the old process
first. Why not allowing something similar in pine 4.x?

Regards,

Andre : [email-masked]

----------------------------------------------------------------------