Subject: RE: compiling pine

From: Hong Tian <[email-masked]>
Date: Wed, 16 Oct 2002 17:13:00 -0400

Thanks Eduardo, Timothy, and Richard. I will create a script to do it.

-----Original Message-----
From: Eduardo Chappa [mailto:[email-masked]]
Sent: Wednesday, October 16, 2002 4:22 PM
To: Hong Tian
Cc: Pine Discussion Forum
Subject: RE: compiling pine

*** Hong Tian ([email-masked]) wrote today:

:) Pine works good after compiling SSL into it. I compiled with
:) PASSFILE='pinepass'. It looks that I need to create the "pinepass" file
:) for each users. We have hundreds of users. Should I create all hundreds
:) of "pinepass" files, or there may be a way to create only one
:) "pinepass" file on the top of root? Do you know the simple solution?

Right, create a passfile for each user, or let every user create it by
themselves, do not create one for everybody, as it's very easy to decrypt
it if it falls in the wrong hands.  In PC-Pine a user has the ability to
specify the location of the password file from the command line, I have a
patch in my web page that allows you to do the same but for unix Pine (the
disadvantage is that the location of the password file, but not its
content, will be visible when you execute the "ps" command).

My advise would be that whatever you do, create a password file that will
be hidden from the view of the user, so that they can not tamper with it
in any way. Normally running a script as root that "touches" the password
file for every user should solve this problem for you, and this should be
fast.

-- 
Eduardo
http://www.math.washington.edu/~chappa/pine/

---

From: Hong Tian <[email-masked]>
Date: Thu, 17 Oct 2002 08:36:18 -0400

Thanks!

-----Original Message-----
From: Nancy McGough [mailto:[email-masked]]
Sent: Thursday, October 17, 2002 5:32 AM
To: Hong Tian
Cc: Pine Discussion Forum
Subject: RE: compiling pine

> :) PASSFILE='pinepass'. It looks that I need to create the "pinepass" file

Before you do this, you might want to name pinepass something a
little more mysterious so if someone breaks into the system, it
won't be so obvious that that's a password file. For example:

 .pp
 ...
 .something

Good luck,
Nancy

PS - be aware that these passwords are going to be easy to crack
for anyone on the system.

-- 
       PROCMAIL  <http://www.ii.com/internet/robots/procmail/qs/>
           IMAP  <http://www.ii.com/internet/messaging/imap/isps/>
           PINE  <http://www.ii.com/internet/messaging/pine/>

--  I N F I N I T E  I N K    www.ii.com    N A N C Y  M c G O U G H  --