Subject: Passwordless Pine FAQ candidate

From: Scott Leibrand <[email-masked]>
Date: Tue, 28 Dec 1999 19:46:51 -0800 (PST)

Two FAQ candidates.  Please tell me what you think:

Title:  Eliminating repeated password prompts in Pine.

Question:  How come Pine keeps asking for my password every time I open a
folder?

Answer:  Probably because it is confused about who to log in as.

To clear up the confusion, edit your .pinerc and /user=yourusername to
every instance of your mail server address.  For example,
{mail.mydomain.com}INBOX would become
{mail.mydomain.com/user=myusername}INBOX.

No matter what you do to try and save your password, it won't work unless
you fix this problem first.

Title:  Using Pine with SSH for passwordless access.

Question:  I'm running Pine on a Unix machine with my mail on an IMAP
server, and I have to type in a password every time I want to read my
mail.  Is there any way I can set it up so I don't have to type my
password?

Answer:  Yes, but how secure your password is depends on how you do it.

The traditional way to do this has been to create a PASSFILE that contains
a very weakly encrypted copy of your password.  This works fine, except
that your password is no more secure than the PASSFILE.  If you want to
set up a PASSFILE anyway, you can find directions at
<http://www.washington.edu/pine/tech-notes/installation.html>.

A much better way is to use the Secure Shell (SSH) protocol and set up a
public-private key pair to allow passwordless connections between two
trusted servers.  All connections with SSH are encrypted and unreadable by
password sniffers, so your password is much safer than if you typed in
your password the old-fashioned way.  One other nice thing about using SSH
is that you can open a telnet-style connection between hosts and even
forward X11 (X-term) connections between hosts, all without having to
type in your password.  And if you're really lazy, you can even use Tera
Term Pro with TTSSH (see Nancy McGough's links at
<http://www.ii.com/internet/messaging/pine/index.html#telnet>) and get
passwordless telnet access from your PC.  But I digress.  :)

For Pine to use SSH, both hosts involved (the machine you run Pine on and
the IMAP server) must support SSH, and you must have access to the
~/.ssh/authorized_keys file on your IMAP server.  It's easiest to set
things up if you have access to a shell on your IMAP server as well, but
it's not absolutely necessary.

First, you need to set up a public-private key pair.  This is usually done
using ssh-keygen, which you run on the client computer (the one you run
Pine on):

- From a shell prompt, type ssh-keygen.
- ssh-keygen will generate some random numbers, then ask you where to put
the private key.  The default should be fine, in most cases.
- Next it asks for a "passphrase" and ask you to confirm it.  This is
basically a password to go with your key.  If you want passwordless
access, you'll want to leave the passphrase blank.  This will mean that
anyone who gets a-hold of your private key can access your account, though,
so be careful about what you do with it.
- Then it will generate the file you specified, and another file in the
same place with .pub on the end.  This is your public key - the one you
want to put on the IMAP server.

To authorize connections from your Pine machine to the IMAP server, you
need to insert the contents of your public key into the
~/.ssh/authorized_keys file on the IMAP server.  You can have more than
one public key in that file, but each needs to be on its own line, and NOT
WORD WRAPPED.  That means using the -w flag if you edit it with Pico.

Once you've got your keys in the right place, test the connection by
typing:

ssh my.imap.server

from a shell prompt on your Pine machine.  It should connect without
requiring a password.  If it does require a password, then your keys
aren't set up right.

If the connection goes through, you'll want to tell Pine to use SSH now.  
To do so, edit your .pinerc and edit the following lines (use the correct
path to ssh, of course.  You can usually determine it by typing "which
ssh"):

# Sets the name of the command used to open a UNIX secure shell
# connection.  Typically this is /usr/local/bin/ssh.
ssh-path=/usr/local/bin/ssh

# Sets the format of the command used to open a UNIX secure
# shell connection.  The default is "%s %s -l %s exec /etc/r%sd"
# NOTE: the 4 (four) "%s" entries MUST exist in the provided command
# where the first is for the command's path, the second is for the
# host to connect to, the third is for the user to connect as, and the
# fourth is for the connection method (typically "imap")
ssh-command=%s %s -q -l %s exec /etc/r%sd

Once that is set, you should have passwordless access to your mail in
Pine.  Now you can start playing with other applications of SSH...  :)

-- 
Scott Leibrand
[email-masked]
http://students.washington.edu/leibrand
* RCW 19.190 notice: This email address is located in Washington State. *
* Unsolicited commercial email may be billed $500 per message.          *

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------