Subject: smth authentication

From: "Stefan K. Schneider" <[email-masked]>
Date: Wed, 13 Mar 2002 22:50:06 +0100

Hi group!

Linux i686 Pine 4.44

As YAHOO have implemented plain SMTP authentication, I have browsed the PINE documentation and the online archives on how to configure this. Still after quite a long time I haven't found any specific config info on SMTP authentication.

But from unrelated docs on IMAP authentication I conclude that I may need to add /user=myusername to the smtp-server line.

Is this correct? If so, why am I not prompted for a password, but get "SMTP Authentication cancelled" after the warning ">SECURITY PROBLEM: insecure server advertised AUTH=PLAIN<"?

YAHOO's server supports plain smtp auth:

Trying 216.136.173.12...
Connected to smtp.mail.yahoo.com.
Escape character is '^]'.
220 smtp016.mail.yahoo.com ESMTP
EHLO myhost.mydomain
250-smtp016.mail.yahoo.com
250-AUTH=LOGIN PLAIN
250-PIPELINING
250 8BITMIME
quit
221 smtp016.mail.yahoo.com

What do I need to do to get SMTP AUTH working with PINE? Why is there no specific information on SMTP AUTH?

Cheers,
Stefan

Is your boss reading your email? ....Probably
Keep your messages private by using Lycos Mail.
Sign up today at http://mail.lycos.com
-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Tue, 19 Mar 2002 10:45:40 -0800 (Pacific Standard Time)

I have analyzed the SMTP authentication problem between Pine and Yahoo.

The problem is a bug in Yahoo's SMTP server.  In its implementation of the
PLAIN authentication mechanism, it sends a bogus "334 ok, go on" response
to the AUTH PLAIN command:

S:	220 smtp016.mail.yahoo.com ESMTP
C:	ehlo tomobiki-cho.cac.washington.edu
S:	250-smtp016.mail.yahoo.com
S:	250-AUTH=LOGIN PLAIN
S:	250-PIPELINING
S:	250 8BITMIME
C:	auth plain
S:	334 ok, go on			<== this is bogus!!!

The correct response is "334 ".  What follows after the 334 and a space is
a server challenge, represented in BASE64 according to the SASL
specification (RFC 2222) and the SMTP service specification for
authentication (RFC 2554).  Pine is unable to interpret "ok, go on" as any
sort of valid SASL challenge, and aborts the authentication.

The "security problem" warning is a separate issue.  It is merely a
diagnostic, and is neither the cause nor a symptom of your inability to
authenticate.  RFC 2595, the specification for the PLAIN SASL mechanism,
requires that PLAIN may only be offered in an SSL or TLS-secured session.
Yahoo's SMTP server does not offer SSL/TLS security, therefore it should
not offer PLAIN.  Nor should it offer LOGIN, for that matter; however,
LOGIN is a non-standard SASL mechanism and thus is not under the same
restriction.

The important thing though is that that "security problem" message is just
a warning message, and isn't actually a cause of the problem.

Yahoo appears to be running a qmail-based SMTP server.  Someone should
report these bugs to the maintainers of qmail:
 1) bogus "ok, go on" in the 334 challenge.
 2) offering PLAIN without TLS support
It won't be me.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.