Subject: webmail pop login problem

From: Lisa Bogue <[email-masked]>
Date: Fri, 3 Oct 2003 13:40:17 -0700 (PDT)

Dear List-
I don't know if the problem I'm having is with the uw-imap software, but posting 
here seemed a good place to start.

I have a mail server built on solaris 8 that I just upgraded/patched the code 
on.  The server has opensourse sendmail (8.12.10), uw-imap, a webmail 
application purchased from sendmail called sendmail mobile messaging server 
(running as a cgi on apache 1.3.26) and a sun crypto accelerator card.   The 
accelerator card uses sun's implementation of openssl 0.9.6j [engine] 10 Apr 
2003.  Sendmail and imap are both compiled against the sun crypto accelerator 
libraries.  Apache mod_ssl is supplied by sun.  The cert is self-signed.  When I 
compiled imap-2002e, both imap and pop work fine for normal mail client 
connections.  However, the webmail application fails to connect to the pop 
server with the incredibly vague error message:

An error was returned by the mail server:
Error connecting to pop server 
Please try again.

The webmail log file shows a logout (but no login).

In my maillog, all I get is this:

-------------------snip---------------------
Oct  2 18:15:14 becrux ipop3d[412]: [ID 806292 mail.debug] pop3 service init fro
m <ip number>
Oct  2 18:15:14 becrux ipop3d[412]: [ID 533678 mail.info] Logout user=??? host=b
ecrux.ligo.caltech.edu [<ip number>]
-------------------snip---------------------

This behavior was the same after compiling both imap-2002e and the development 
snap from 9/25 and stayed the same irrespective of whether the webmail 
application was using secure or insecure pop logins.  When I copy back my 
imapd/popd from my pre-existing build, everything works fine.  The original 
build was imap-2002, Release notes date 28 October 2002 (IMAP4rev1 2002.332). 
The customized parameters from my Makefile are below.  Aside from the addition 
of SSLKEYS, the makefiles for all versions are the same.

There is a new version of the webmail client out and it's possible that the 
problem might clear up once I update that.  Still, I was hoping that someone 
here might have an idea of what the problem might be.

Thanks in advance for any thoughts-

Lisa
-------------------------
Lisa Bogue
System Administration Group
Ligo Project
[email-masked]
phone: 626-395-8739

------------Makefile------------------
# Command line build parameters

EXTRAAUTHENTICATORS=
EXTRADRIVERS=mbox
#PASSWDTYPE=std
PASSWDTYPE=pmb
SSLTYPE=unix

# Extended flags needed for SSL.  You may need to modify.

SSLDIR=/opt/SUNWconn/crypto/
SSLCERTS=/usr/local/ssl/certs
SSLKEYS=$(SSLCERTS)
SSLINCLUDE=$(SSLDIR)/include
SSLLIB=$(SSLDIR)/lib

SSLCRYPTO=-lcrypto -lcryptography -lnvpair

# Older versions of MIT Kerberos also have a libcrypto.  If so, you may need
# to use this instead
#SSLCRYPTO=$(SSLLIB)/libcrypto.a

# RSA Security Inc. released the RSA public key encryption algorithm into
# the public domain on September 6, 2000.  There is no longer any need to
# use RSAREF.
SSLRSA= # -lRSAglue -lrsaref

SSLCFLAGS= -I$(SSLINCLUDE) -I$(SSLINCLUDE)/openssl\
 -DSSL_CERT_DIRECTORY=\"$(SSLCERTS)\" -DSSL_KEY_DIRECTORY=\"$(SSLKEYS)\"
SSLLDFLAGS= -L$(SSLLIB) -R/opt/SUNWconn/crypto/lib -lssl $(SSLCRYPTO) $(SSLRSA)
------------------------------------------

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Fri, 3 Oct 2003 13:54:06 -0700 (Pacific Daylight Time)

The "Logout user=???" message indicates that the client gave a POP3 QUIT
command without ever logging in.

If you are not seeing any "Login failed" or "Login disabled" error
messages, that means that the client never attempted to log in.

I suspect that your pre-existing ipop3d build was one which permitted
password logins in an unencrypted session (meaning every bad guy in the
world can sniff passwords).  By default, ipop3d no longer permits use of
password-type authentication unless the session is encrypt.

Try running the two copies of ipop3d under the shell.  To each one, do a
CAPA command.  Let me know what the results are.  That will show if my
guess is correct.

If it is, then the reason why your mail clients are working is that they
are using encryption (either SSL or TLS), but your webmail is not.  You
then have two choices:

1) fix your webmail to use encryption.

2) break ipop3d to allow insecure logins, and accept that every so often
your system is going to be hacked.

Not surprisingly, I recommend choice (1).

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.