Subject: IMAP telemetry in UNIX

From: Doc Gorby <[email-masked]>
Date: Wed, 30 May 2001 07:35:32 -0400 (EDT)

In pc-pine there is a item called
Config -> IMAP telemetry which displays the
communication between pine and the IMAP server.

How can this be done using unix-pine?

I see no reference to this in the FAQ or other
pine Doc's.

TIA

-- 

Keep Well

=-=-=-=-=
 Doc
=-=-=-=-=

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Eduardo Chappa <[email-masked]>
Date: Wed, 30 May 2001 08:09:29 -0700 (PDT)

*** Doc Gorby ([email-masked]) wrote in the pine-info list today:

:) In pc-pine there is a item called Config -> IMAP telemetry which
:) displays the communication between pine and the IMAP server.

In order to save the telemetry, you must either start Pine with the
flag "-d imap=4" (whis displays the maximum possible telemetry) or add the
/debug option to the definition of the server:

inbox-path = {your.imap.server/debug[/other_flags]}INBOX

-- 
Eduardo
http://www.math.washington.edu/~chappa/pine/

---

From: "Leonard J. Moss" <[email-masked]>
Date: Wed, 30 May 2001 10:58:40 -0700 (PDT)

One word of warning: At the imap=4 debugging level (in UNIX Pine -- I
have no experience with PC-Pine) your password will appear in the
clear in the .pine-debug1 file.

---

From: Eduardo Chappa <[email-masked]>
Date: Wed, 30 May 2001 11:11:10 -0700 (PDT)

*** Leonard J. Moss ([email-masked]) wrote in the pine-info list today:

:) One word of warning: At the imap=4 debugging level (in UNIX Pine -- I
:) have no experience with PC-Pine) your password will appear in the
:) clear in the .pine-debug1 file.

It's true that the password will appear, but won't be readable in the
sense that you can know what it is, you still need to decode it in order
to know what it is. However, you can use the information in that file, as
it is, to log into the server, and it's not difficult to make a program
that will decode that information, so as Leonard is saying, be careful
with that information.

---

From: "Leonard J. Moss" <[email-masked]>
Date: Wed, 30 May 2001 15:12:32 -0700 (PDT)

When I raise the imap debug level to 4 on my system (running UNIX
Pine 4.33 with SSL) I get a line like the following in my
.pine-debug1 file:

   IMAP DEBUG 10:50:33.167011 5/30: 00000001 LOGIN ljm XXXXXXXX

where the XXXXXXXX actually contains the clear-text form of the
password that I typed to get a connection to my IMAP server, i.e., it
is _not_ the encrypted form of my password.

---

From: Eduardo Chappa <[email-masked]>
Date: Wed, 30 May 2001 18:18:28 -0700 (PDT)

:) When I raise the imap debug level to 4 on my system (running UNIX
:) Pine 4.33 with SSL) I get a line like the following in my
:) .pine-debug1 file:
:)
:)    IMAP DEBUG 10:50:33.167011 5/30: 00000001 LOGIN ljm XXXXXXXX
:)
:) where the XXXXXXXX actually contains the clear-text form of the
:) password that I typed to get a connection to my IMAP server, i.e., it
:) is _not_ the encrypted form of my password.

Oh wow. There's something wrong in there. I see no reason to authenticate
with a login command, less save this unencrypted information in clear
text. Pine should be issuing a AUTHENTICATE PLAIN command to the server,
because you said it is using SSL, so maybe you do not have a SSL
connection to the server, as you thought you did. Can you see a "+" sign
in your top right corner?

---

From: "Leonard J. Moss" <[email-masked]>
Date: Wed, 30 May 2001 18:32:59 -0700 (PDT)

Yes, I have a "+" sign in the top right corner.  I also happen to
know that our server (Microsoft Exchange) will only accept SSL
connections.

BTW, I think I reported this as a bug some time ago, though perhaps
too late to make it into 4.33.  I've been hoping that there would be
a fix in the next release.

---

From: Eduardo Chappa <[email-masked]>
Date: Wed, 30 May 2001 18:43:59 -0700 (PDT)

*** Leonard J. Moss ([email-masked]) wrote today:

:) Yes, I have a "+" sign in the top right corner.  I also happen to
:) know that our server (Microsoft Exchange) will only accept SSL
:) connections.
:)
:) BTW, I think I reported this as a bug some time ago, though perhaps
:) too late to make it into 4.33.  I've been hoping that there would be
:) a fix in the next release.

Ok, I think I understand now. Exchange must not know the AUTH=LOGIN method
of authentication, which gives you some sensation of encryption. The point
is that the SSL connection must be established before you even
authenticate, so it does not matter what you send afterwards, because it's
already encrypted.

 What kind of improvement do you expect?, is it that Pine do not record
LOGIN information in the .pine-debug files?

---

From: "Leonard J. Moss" <[email-masked]>
Date: Wed, 30 May 2001 19:31:55 -0700 (PDT)

> LOGIN information in the .pine-debug files?

Yes, exactly.

---

From: "Leonard J. Moss" <[email-masked]>
Date: Wed, 30 May 2001 19:44:46 -0700 (PDT)

> LOGIN information in the .pine-debug files?

Oops, I just shot off a quick reply without thinking it through.

My first choice would be to see the .pine-debug file record all of
the LOGIN information _except_ the password.  For example, the
password could be replaced by a string of X-s as I did by hand in a
previous reply on this thread, or by some other string (e.g.,
"<password-omitted>") which most people would be able to recognize
as a place-holder for the real password.

If this is difficult to implement (sorry, I don't understand the
internals of Pine or SSL well enough to judge from your explanation
above), then my second choice would be to suppress all the LOGIN
information.

---

From: "Mike A. Harris" <[email-masked]>
Date: Wed, 30 May 2001 22:50:38 -0400 (EDT)

>above), then my second choice would be to suppress all the LOGIN

I can't imagine it being more than a one or two line change to
the sources myself..

----------------------------------------------------------------------
Mike A. Harris                  Shipping/mailing address:
OS Systems Engineer             190 Pittsburgh Ave., Sault Ste. Marie,
Red Hat Inc.                    Ontario, Canada, P6C 5B3
http://www.redhat.com           Phone: (705)949-2136
----------------------------------------------------------------------
Latest XFree86 test RPMS:      ftp://people.redhat.com/mharris/testing