Subject: Keeping passwords in Pine 4.0x

From: Dave Hansen <[email-masked]>
Date: Wed, 5 Aug 1998 14:35:35 -0700

Can the password for an IMAP mailbox be retained in Pine somehow?
Dave Hansen
[email-masked]

-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: David Dyck <[email-masked]>
Date: Wed, 5 Aug 1998 16:26:16 -0700

The DOS version does keep the passwords, but the unix versions
don't.  I had reason to keep the password for unix also, 
so I hacked the source code for pine 3.96 in the appropriate spots,
and made the password file be group readable.

 look for code with
   #if defined(DOS) || defined(OS2)
 around or near code that matches /passwd/

in pine/ imap.c

also in init.c near "user-id"

I also made some changes in os.c and send.c

On Wed, 5 Aug 1998, Dave Hansen wrote:

> From: Dave Hansen <[email-masked]>
>

---

From: Mike Brudenell <[email-masked]>
Date: Tue, 11 Aug 1998 11:54:29 +0100

Someone asks a legitimate question...

> Can the password for an IMAP mailbox be retained in Pine somehow?

..and is told this in reply...

> I also made some changes in os.c and send.c

In actual fact the UNIX version, in most setups, does not need to store the
password because a better and more secure system is available instead:
namely use of the standard "rsh" mechanism.

The "rsh" command allows one UNIX system to connect to another (suitably
configured) system and either start a shell or execute a command string ...
all without having to supply a username or password.

This is possible when the target system has been told it can trust
connections originating from one or more source machines.  The rsh
mechanism itself sorts out the username side, and the fact it is using
privileged ports implies that the connection information has to come from a
privileged program and hence can be trusted.

So for consenting UNIX systems this is what you have to do...

1.  Set up your IMAP server software to allow "pre-authenticated"
connections...  This is done very simply, just by creating a symbolic link
from /etc/rimapd to point to your real imapd executable.

2.  Set up your IMAP server machine's rsh mechanism to trust connections
for you/everyone on the client machine(s).  At a personal level this can be
done by setting up a ".rhosts" file in your home directory; at a systemwide
level it can be done with a "/etc/hosts.equiv" file.  See these man pages
for further information:
	man rsh       (the remote shell command: not the restricted shell page)
	man rshd
	man hosts.equiv
	man rhosts
If you are not familiar with the rsh mechanism do seek advice from your
local support centre: setting it up incorrectly can open up security holes.

3.  Start Pine.  By default it will attempt to open a pre-authenticated
rsh-based connection and execute the /etc/rimapd command before falling
back to an unauthenticated TCP/IP connection to port 143 (which will then
require you to enter a username and password).

As you can see this mechanism avoids the need to have passwords stored
anywhere.

Systems Administrators should note that setting up rsh access in this way
will allow users to execute any command or start a shell session on the
server.  If this is a problem then you should consider setting the shell of
users on the servers to some restricted program that only allows limited
commands to be used (in particular the /etc/rimapd program).

Cheers,

Mike B-)
--
The Computing Service, University of York, Heslington, York, Yo10 5DD, UK
Tel:+44-1904-433811   Fax:+44-1904-433740    http://www.york.ac.uk/~pmb1/
*******  Unsolicited commercial/bulk e-mail is NOT welcome here!  *******

---

From: Jeff A Kinsey <[email-masked]>
Date: Tue, 11 Aug 1998 09:01:32 -0400 (EDT)

> > Can the password for an IMAP mailbox be retained in Pine somehow?
<< stuff deleted >>
> namely use of the standard "rsh" mechanism.

as a security nut, i have a problem with rsh and 'trusted' unix
partners [hosts]... i do not use IMAP, so maybe i am off base;
however, with POP3 i use fetchmail for each user to get his mail off
the server. and sending mail is accomplished with sendmail. 

why? bacause my firewall does not allow ANY incoming traffic that is
not a result of an outgoing request [like from fetchmail]. yes, it
does take more admin effort. but is your security worth it? mine is.

-jeff