Subject: pine, pc-pine and smtp-auth

From: Steffan Henke <[email-masked]>
Date: Tue, 25 Jun 2002 20:05:39 +0200 (CEST)

I am using both linux pine (RH 7.2 and 7.3) and pc-pine and my ISP is 
going to change to smtp-auth soon. I searched the archives about my 
problem, but found only the thread about yahoo!'s implemantation.
The mailhost offers me the following:
250-AUTH PLAIN LOGIN

But when trying to send mail, I receive
[>SECURITY PROBLEM: insecure server advertised AUTH=PLAIN<]

I tried disabling the other authentification modules like
#disable-these-authenticators=CRAM-MD5
#disable-these-authenticators=GSSAPI 
#disable-these-authenticators=LOGIN

but still cannot send using AUTH=PLAIN.

Is there any documentation on that I haven't found yet ?

TIA,

Steffan Henke

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Tue, 25 Jun 2002 13:20:57 -0700 (Pacific Daylight Time)

> [>SECURITY PROBLEM: insecure server advertised AUTH=PLAIN<]

This is just a warning.  The specification for the AUTH=PLAIN SASL
authentication mechanism indicates that it is only allowed in encrypted
(SSL or TLS) sessions, because bad guys can snoop on your password.

If you are getting an error message saying "SMTP Authentication
cancelled", the actual problem has nothing to do with that warning, but is
instead a bug in that server.

An unsupported patch to qmail which implements SMTP-SASL has a known bug
that renders it non-compliant with the specification (RFC 2554, RFC 2222).

The qmail developers have asked me to emphasize that this is *not* a bug
in qmail, but rather in an unsupported patch that they have nothing to do
with.

The unsupported patch to qmail issues an erroneous response which causes
the authentication to be cancelled.  This problem will affect AUTH=GSSAPI
and AUTH=PLAIN, but will not affect AUTH=CRAM-MD5 or AUTH=LOGIN.

Supposedly, the author of the unsupported patch has issued an update which
will fix this.

> but still cannot send using AUTH=PLAIN.

Don't disable CRAM-MD5 or GSSAPI or LOGIN.

Try disabling PLAIN instead.  That will force it to use LOGIN which should
work.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.

---

From: Steffan Henke <[email-masked]>
Date: Tue, 25 Jun 2002 22:44:38 +0200 (DST)

> instead a bug in that server.

Mark,

the MTA used is exim.

> Try disabling PLAIN instead.  That will force it to use LOGIN which should

Great - that did the trick ! Thx alot, really appreciate your help.

Regards,

Steffan