Subject: [Imap-uw] Problem with pop before smtp

From: Mariano Wahlmann <[email-masked]>
Date: Thu, 08 Sep 2005 13:49:13 -0300

I had a pop before smtp watching at maillog to catch authenticated 
users. but when a client uses SASL this records do not appear, and the 
Logout record says Logout user=???, how can i get one record for each 
authenticated user?

Thanks,

_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Mark Crispin <[email-masked]>
Date: Thu, 8 Sep 2005 11:01:09 -0700 (PDT)

On Thu, 8 Sep 2005, Mariano Wahlmann wrote:
> I had a pop before smtp watching at maillog to catch authenticated users. but 
> when a client uses SASL this records do not appear, and the Logout record 
> says Logout user=???, how can i get one record for each authenticated user?

If you see "Logout user=???" that means that the POP client never logged 
in.

A SASL authentication will show "Auth user" instead of "Login user".

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: David B Funk <[email-masked]>
Date: Thu, 8 Sep 2005 13:14:10 -0500 (CDT)

> Logout record says Logout user=???, how can i get one record for each

two different suggestions:

1) Switch to SMTP-AUTH for sending. It's more work to support (teaching
   your users how to configure their clients, etc) but more secure and
   reliable in the long run.

2) If you must use "pop before smtp" use DRAC rather than maillog
   watchers (see: http://mail.cc.umanitoba.ca/drac/index.html ).
   We used DRAC for several years before switching to SMTP-AUTH.
   Particularly if you need to support IMAP clients, DRAC is far
   superior to maillog watchers, altho it is a bit of work to integrate
   into your pop3d & imapd daemons.

Dave

-- 
Dave Funk                                  University of Iowa
<dbfunk (at) engineering.uiowa.edu>        College of Engineering
319/335-5751   FAX: 319/384-0549           1256 Seamans Center
Sys_admin/Postmaster/cell_admin            Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Mark Crispin <[email-masked]>
Date: Thu, 8 Sep 2005 11:59:34 -0700 (PDT)

On Thu, 8 Sep 2005, David B Funk wrote:
> 1) Switch to SMTP-AUTH for sending.
>   watchers

For what it's worth, I agree with both suggestions, especially the first 
suggestion.  I have never supported "POP before SMTP" in my distributions, 
but I do support SMTP-AUTH.

-- Mark --

http://panda.com/mrc

---

From: Mariano Wahlmann <[email-masked]>
Date: Thu, 08 Sep 2005 16:07:38 -0300

Look at the tcp dump;

+OK POP3 pop3.agro.uba.ar v2001.78rh server ready
CAPA
+OK Capability list follows:
TOP
LOGIN-DELAY 180
UIDL
STLS
USER
SASL LOGIN
.
AUTH LOGIN
+ VXNlciBOYW1lAA==
NO WAY
+ UGFzc3dvcmQA
NO WAY AGAIN
+OK Mailbox open, 0 messages
STAT
+OK 0 0
QUIT
+OK Sayonara

and maillog for the session:
Sep  8 16:04:53 eclipse ipop3d[25587]: pop3 service init from 168.96.156.99
Sep  8 16:04:53 eclipse ipop3d[25587]: Logout user=??? 
host=petrus.agro.uba.ar [168.96.156.
99]

P.D: I'd changed the user and pass in the tcp dump.

Is this maybe because and old version?

Mark Crispin wrote:

>> this are the logs for a SUCCESSFULL pop3 session.
>> Sep  4 22:06:38 eclipse ipop3d[4187]: pop3 service init from 
>> 168.96.156.99
>> Sep  4 22:06:38 eclipse ipop3d[4187]: Logout user=??? 
>> host=petrus.agro.uba.ar [168.96.156.99]
>
>
> That is not a successful POP3 session.  That is a session that 
> connected and immediately disconnected.
>
> -- Mark --
>
> http://panda.com/mrc

-- 
________________________________________________________
Mariano Agustín Wahlmann
Administrador de Red
Facultad de Agronomía - Buenos Aires - Argentina
Te.: (+54 11) 4524-8000 int.8108
email: mailto:[email-masked]
www: http://www.agro.uba.ar

---

From: Mariano Wahlmann <[email-masked]>
Date: Thu, 08 Sep 2005 16:12:24 -0300

I'm used this log not only for popB4smtp, i also use this log to know 
when was the last time that user check his account, in order to disable 
accounts that are not being checked.

Mark Crispin wrote:

> For what it's worth, I agree with both suggestions, especially the 
> first suggestion.  I have never supported "POP before SMTP" in my 
> distributions, but I do support SMTP-AUTH.
>
> -- Mark --
>
> http://panda.com/mrc

---

From: Mark Crispin <[email-masked]>
Date: Thu, 8 Sep 2005 12:39:54 -0700 (PDT)

If that is actually happening then you have a broken server.  It seems to 
have been modified by RedHat.

I looked at the distribution imap-2001a ipop3d (not the RH hacked version) 
and it can not behave in that way.  In the distribution sources, "Logout 
user=???" only happens if user is null, and "Mailbox open" only happens if 
user is non-null.

Try unmodified sources from UW (not to mention being far more up to date):
 	ftp://ftp.cac.washington.edu/mail/imap.tar.Z

-- Mark --

http://panda.com/mrc