Subject: RE: Keeping passwords in Pine 4.0x

From: Dave Hansen <[email-masked]>
Date: Tue, 11 Aug 1998 07:28:21 -0700

Yes, but we don't connect to a UNIX based imap server.  Rather MS
Exchange.  Any ideas to make Pine retain the password for the Exchange
environment?  Thanks for your reply.
-Dave Hansen

> -----Original Message-----
> From: Mike Brudenell [mailto:[email-masked]]
> Sent: Tuesday, August 11, 1998 3:54 AM
> To: Dave Hansen; David Dyck
> Cc: Pine Discussion Forum
> Subject: Re: Keeping passwords in Pine 4.0x
> 
> 
> Someone asks a legitimate question...
> 
> --On Wed, Aug 5, 1998 2:35 pm -0700 Dave Hansen <[email-masked]> wrote:
> 
> > Can the password for an IMAP mailbox be retained in Pine somehow?
> > Dave Hansen
> 
> ..and is told this in reply...
> 
> --On Wed, Aug 5, 1998 4:26 pm -0700 David Dyck 
> <[email-masked]> wrote:
> 
> > The DOS version does keep the passwords, but the unix versions
> > don't.  I had reason to keep the password for unix also, 
> > so I hacked the source code for pine 3.96 in the appropriate spots,
> > and made the password file be group readable.
> > 
> >  look for code with
> >    #if defined(DOS) || defined(OS2)
> >  around or near code that matches /passwd/
> > 
> > in pine/ imap.c
> > 
> > also in init.c near "user-id"
> > 
> > I also made some changes in os.c and send.c
> 
> In actual fact the UNIX version, in most setups, does not 
> need to store the
> password because a better and more secure system is available instead:
> namely use of the standard "rsh" mechanism.
> 
> The "rsh" command allows one UNIX system to connect to 
> another (suitably
> configured) system and either start a shell or execute a 
> command string ...
> all without having to supply a username or password.
> 
> This is possible when the target system has been told it can trust
> connections originating from one or more source machines.  The rsh
> mechanism itself sorts out the username side, and the fact it is using
> privileged ports implies that the connection information has 
> to come from a
> privileged program and hence can be trusted.
> 
> So for consenting UNIX systems this is what you have to do...
> 
> 1.  Set up your IMAP server software to allow "pre-authenticated"
> connections...  This is done very simply, just by creating a 
> symbolic link
> from /etc/rimapd to point to your real imapd executable.
> 
> 2.  Set up your IMAP server machine's rsh mechanism to trust 
> connections
> for you/everyone on the client machine(s).  At a personal 
> level this can be
> done by setting up a ".rhosts" file in your home directory; 
> at a systemwide
> level it can be done with a "/etc/hosts.equiv" file.  See 
> these man pages
> for further information:
> 
> 	man rsh       (the remote shell command: not the 
> restricted shell page)
> 	man rshd
> 	man hosts.equiv
> 	man rhosts
> If you are not familiar with the rsh mechanism do seek advice 
> from your
> local support centre: setting it up incorrectly can open up 
> security holes.
> 
> 3.  Start Pine.  By default it will attempt to open a 
> pre-authenticated
> rsh-based connection and execute the /etc/rimapd command 
> before falling
> back to an unauthenticated TCP/IP connection to port 143 
> (which will then
> require you to enter a username and password).
> 
> As you can see this mechanism avoids the need to have passwords stored
> anywhere.
> 
> Systems Administrators should note that setting up rsh access 
> in this way
> will allow users to execute any command or start a shell 
> session on the
> server.  If this is a problem then you should consider 
> setting the shell of
> users on the servers to some restricted program that only 
> allows limited
> commands to be used (in particular the /etc/rimapd program).
> 
> Cheers,
> 
> Mike B-)
> --
> The Computing Service, University of York, Heslington, York, 
> Yo10 5DD, UK
> Tel:+44-1904-433811   Fax:+44-1904-433740    
> http://www.york.ac.uk/~pmb1/
> *******  Unsolicited 
> commercial/bulk e-mail is NOT welcome here!  *******
>

---

From: Arun Arora <[email-masked]>
Date: Tue, 11 Aug 1998 16:24:48 +0100 (BST)

Thanks guys for filling up my mail box  with email messages.

I love to delete them.

---

From: Norbert Koch <[email-masked]>
Date: 11 Aug 1998 17:42:13 +0200

> Thanks guys for filling up my mail box  with email messages.

Hmm, I don't get your point here. If you don't want to even see the
messages, IMHO, you'll have to unsubscrbe from the list. Otherwise ...

> I love to delete them.

; a a d

along with the loss of information you'll earn with it.

Norbert.

-- 
Dr Norbert Koch, DELTA Industrie Informatik GmbH, Fellbach, Germany.
A rattlesnake that doesn't bite teaches you nothing!

---

From: Ian Hall-Beyer <[email-masked]>
Date: Tue, 11 Aug 1998 10:36:55 -0600 (MDT)

> To: Pine Discussion Forum <[email-masked]>
> 

So why are you still subscribed to the list? you signed up for
it, knowing full well it was a mailing list. Might I direct you to the
"unsubscribe" command?

-Ian

---

From: KI7RW <[email-masked]>
Date: Tue, 11 Aug 1998 15:09:47 -0600

Perhaps someone else subscribed him to the listserver?

---

From: Ian Hall-Beyer <[email-masked]>
Date: Tue, 11 Aug 1998 14:01:08 -0600 (MDT)

> Perhaps someone else subscribed him to the listserver?

At which point he would have received a confirmation email with
instructions on how to unsubscribe.

-Ian (advocate of subscription confirmations with passwords)