Subject: CRAM-MD5

From: Dave Sill <[email-masked]>
Date: Fri, 11 Feb 2000 14:40:33 -0500 (EST)

I installed 4.5 on a Solaris 7 box, and login authentication works
fine, but I can't get CRAM-MD5 to successfully authenticate using
fetchmail (the only client I have handy). Here's a sample session:

$ fetchmail -vv
Enter password for de5@emaildev: 
fetchmail: 5.1.0 querying emaildev (protocol unknown?!?) at Fri, 11 Feb 2000 12:04:53 -0500 (EST)
fetchmail: IMAP< * OK emaildev.cind.ornl.gov IMAP4rev1 v12.250 server ready
fetchmail: IMAP> A0001 CAPABILITY
fetchmail: IMAP< * CAPABILITY IMAP4 IMAP4REV1 NAMESPACE IDLE SCAN SORT MAILBOX-REFERRALS LOGIN-REFERRALS AUTH=CRAM-MD5 AUTH=LOGIN THREAD=ORDEREDSUBJECT
fetchmail: IMAP< A0001 OK CAPABILITY completed
fetchmail: Protocol identified as IMAP4 rev 1
fetchmail: CRAM-MD5 authentication is supported
fetchmail: IMAP> A0002 AUTHENTICATE CRAM-MD5
fetchmail: IMAP< + PDI4MDE5Ljk1MDI4ODY5M0BlbWFpbGRldi5jaW5kLm9ybmwuZ292Pg==
fetchmail: decoded as <[email-masked]>
fetchmail: replying with de5 3033432ab1f5a38f05645af2e373ce05
fetchmail: IMAP> ZGU1IDMwMzM0MzJhYjFmNWEzOGYwNTY0NWFmMmUzNzNjZTA1
fetchmail: IMAP< A0002 NO AUTHENTICATE CRAM-MD5 failed
fetchmail: IMAP> *
fetchmail: Authorization failure on de5@emaildev
fetchmail: IMAP> A0003 LOGOUT
fetchmail: IMAP< * BAD Missing command
fetchmail: IMAP< * BYE emaildev.cind.ornl.gov IMAP4rev1 server terminating connection
fetchmail: IMAP< A0003 OK LOGOUT completed
fetchmail: authorization error while fetching from emaildev
fetchmail: Query status=3
fetchmail: normal termination, status 3
fetchmail: Deleting fetchids file.

I've added some syslog debugging to c-client/auth_md5.c, and I can see 
that it's reading the correct password from /etc/cram-md5.pwd.

How can I figure out what's going wrong?

-Dave
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Fri, 11 Feb 2000 11:57:02 -0800 (PST)

c-client's CRAM-MD5 support has been in production use for a long time.  The
problem is most likely in fetchmail, and I suggest that you contact the
developer of fetchmail.  I seem to remember that some version of fetchmail did
something bogus like write quotes around the tokens.

By the way, imap-4.5 is an old version.  Get imap-4.7a:
	ftp://ftp.cac.washington.edu/mail/imap.tar.Z

Pine uses CRAM-MD5.

---

From: Dave Sill <[email-masked]>
Date: Fri, 11 Feb 2000 15:31:25 -0500 (EST)

>something bogus like write quotes around the tokens.

OK, I tried the latest version fetchmail (5.2.7) and Eudora Pro 4.2:
still no good.

>	ftp://ftp.cac.washington.edu/mail/imap.tar.Z

I'm stuck with 4.5.

So how can I debug this problem?

-Dave

---

From: Mark Crispin <[email-masked]>
Date: Fri, 11 Feb 2000 12:36:03 -0800 (PST)

> OK, I tried the latest version fetchmail (5.2.7) and Eudora Pro 4.2:

Is the entry in your /etc/cram-md5.pwd file in the exact format as described;
that is, user name, TAB, password, NEWLINE?

Make sure you don't have any extraneous spaces, etc. in the file.

> I'm stuck with 4.5.

Why?  4.5 has known performance problems.

---

From: Dave Sill <[email-masked]>
Date: Fri, 11 Feb 2000 15:46:46 -0500 (EST)

>that is, user name, TAB, password, NEWLINE?

Yep:

# od -c </etc/cram-md5.pwd 
0000000   d   e   5  \t   c   r   a   m   t   e   s   t  \n
0000015

>Why?  4.5 has known performance problems.

The mailboxes are on a Netapp filer, so I need to use maildir format
for reliable delivery via NFS. The only version of imap that has been
patched for maildir is 4.5.

If you know another way to do this, I'm open to suggestions.

-Dave

---

From: Yiorgos Adamopoulos <[email-masked]>
Date: Fri, 11 Feb 2000 22:56:39 +0200

Message-ID: <[email-masked]>
Priority: NORMAL
X-Mailer: Execmail for Win32 Version 5.0.1 Build (55)
MIME-Version: 1.0
Content-Type: Text/Plain; charset="us-ascii"

> If you know another way to do this, I'm open to suggestions.

Dave,

Two ways:

1- [painfull] merge the patches with the current source
2- http://www.inter7.com/courrierimap/ (this I got from 
   http://www.ntua.gr/qmail/top.html)
--
[email-masked] wrote in comp.lang.dylan:
> The *right* people have to be recruited, not hired.

---

From: Mark Crispin <[email-masked]>
Date: Fri, 11 Feb 2000 12:51:03 -0800 (PST)

> patched for maildir is 4.5.

You do not need maildir to do reliable delivery via NFS.  You just need to
make sure that the /var/spool/mail directory is protected 1777.

The issues caused by NFS are in multiple MUAs accessing the same mailbox, and
maildir isn't going to help you with that.  Without a Cyrus-style index
database (which stores all the internaldates, rfc822.sizes, envelopes,
bodystructures, and header texts) to avoid all those open() and stat() calls,
maildir-style storage techniques are much slower than the traditional UNIX
format of mail.  Such a database precludes the use of NFS, so you're back to
where you started.

It's generally a bad idea to use NFS for mailboxes, or for that matter any
other kind of database which has multiple simultaneous read/write access.
You're not gaining any performance by using it.  NFS is alright for C source
files and text files, that kind of thing.

---

From: Dave Sill <[email-masked]>
Date: Mon, 14 Feb 2000 08:14:06 -0500 (EST)

Mark Crispin <[email-masked]>

>make sure that the /var/spool/mail directory is protected 1777.

That assumes that only one system is delivering to /var/spool/mail at
a time. We want multiple systems to be able to deliver to the same
mailboxes.

>maildir isn't going to help you with that.

Also multiple MTA's delivering to the same mailbox--and maildir does
help there. Actually, I think it helps in the case of multiple MUA's,
too. I've read the same maildir mailbox with two mutts before, and it
behaved as well as could be expected.

>files and text files, that kind of thing.

We're more worried about reliability than performance, but performance 
with the Netapp filers is very impressive.

So, back to my question: how can I debug this CRAM-MD5 authentication
problem? Is there a comman-line tool for calculating keyed MD5's so I
can tell whether the MUA's or IMAP is doing it wrong? Any other
approaches?

-Dave

---

From: Mark Crispin <[email-masked]>
Date: Mon, 14 Feb 2000 08:22:25 -0800 (PST)

> a time. We want multiple systems to be able to deliver to the same

I repeat my statement.  You do not need maildir to do reliable delivery via
NFS.  Nor do you need it for multiple MTAs.  Nor do you need it for multiple
MUAs.

All you need is to guarantee exclusive creation of the .lock files.  That is
somewhat more complicated than using O_EXCL, but it is a solved problem.
Refer to the c-client routine dotlock_lock(), and look for the code that
begins with the insipid poem:
	SUN-OS had an NFS,
	As kludgy as an albatross;
	And everywhere that it was installed,
	It was a total loss.

> can tell whether the MUA's or IMAP is doing it wrong? Any other

The first step is to make sure that you're running the latest version of the
software.  CRAM-MD5 works fine for other people who are using it.  What's
different about your system is that you're running an old version of the
software and are declining to upgrade.

---

From: Yiorgos Adamopoulos <[email-masked]>
Date: Mon, 14 Feb 2000 18:54:44 +0200

> software and are declining to upgrade.

Because IIRC, Dave runs Qmail, and that is why he needs Maildir (although I 
believe you can have other delivery styles with Qmail)
--
# man coffee

---

From: Dave Sill <[email-masked]>
Date: Mon, 14 Feb 2000 12:35:43 -0500 (EST)

>NFS.  Nor do you need it for multiple MTAs.  Nor do you need it for multiple

I can't dispute this claim, but there must be some reason Innosoft
won't support delivering to an NFS-mounted mailbox.

Maildir may not be strictly necessary, but it's sufficient.

>software.  CRAM-MD5 works fine for other people who are using it.

Did it work in imap 4.5, or only in the latest version?

>What's different about your system is that you're running an old
>version of the software and are declining to upgrade.

I'm "declining" to upgrade because I don't have maildir patches for
the current version. If 4.5 CRAM-MD5 never worked, then I'm wasting my
time. If it did, then it should work for me, regardless of whether
there's a newer version available.

-Dave

---

From: Dave Sill <[email-masked]>
Date: Mon, 14 Feb 2000 12:47:03 -0500 (EST)

>believe you can have other delivery styles with Qmail)

Yes, I'm using qmail, but that's irrelevant. I don't need maildirs
because I'm using qmail, I'm using qmail because I want maildirs. If I
were using Postfix or sendmail and delivering to maildirs, I'd still
be having the same problem: imap CRAM-MD5 authentication is failing.

Look, I didn't come here for advice about which MTA to use, how to
deliver safely via NFS, or recommendations to use the latest version
of imap. I have two questions. If anyone can answer either of them,
that would be great. Otherwise, no response is required.

The questions are:

1) does CRAM-MD5 authentication work right with imap 4.5, and

2) assuming the answer to (1) is yes, how can I figure out why mine is 
   failing to authenticate properly?

-Dave

---

From: Yiorgos Adamopoulos <[email-masked]>
Date: Mon, 14 Feb 2000 20:02:23 +0200

Message-ID: <[email-masked]>
Priority: NORMAL
X-Mailer: Execmail for Win32 Version 5.0.1 Build (55)
MIME-Version: 1.0
Content-Type: Text/Plain; charset="us-ascii"

On Mon, 14 Feb 2000 12:47:03 -0500 (EST) Dave Sill 
<[email-masked]> wrote:
[ ... ]
> Look, I didn't come here for advice about which MTA to use, how to
[ ... ]

It was not my intent to point to you which MTA to use.  If it seemed that way, 
it may be because English is not my native language (unlike you).

--
# man coffee

---

From: Mark Crispin <[email-masked]>
Date: Mon, 14 Feb 2000 11:11:31 -0800 (PST)

> won't support delivering to an NFS-mounted mailbox.

Perhaps because NFS is an extremely bad idea; it creates enormous problems and
at best you'll only ever be able to get it to work in a half-hearted way.

I envy Innosoft and the Cyrus folks for having the luxury to flatly prohibit
use of NFS.  I would do the same thing if they'd let me.  We had our own
unfortunate flirtation with NFS, for many of the same reasons that you give
today.  Thankfully, those days are over; but I'm still not allowed to rip out
the NFS code.

> Maildir may not be strictly necessary, but it's sufficient.

Maildir does not (can not) work well with IMAP.  Undoubtably, you're making
completely false assumptions about IMAP loads based upon how (poorly) maildir
works.

> >> problem?
> >The first step is to make sure that you're running the latest version

If it wasn't already obvious, I don't know.  CRAM-MD5 has always worked for
me, in all versions.  There was a time when bad code was generated on some
platforms (not any that I use).  Maybe it applies to you, maybe it doesn't.

CRAM-MD5 is not particularly easy to debug.  You can't decode what has been
encoded.  You can make the IMAP server log the string that it expects vs. the
string provided by the client.  There's a few other things to try, but it
quickly gets messy.

But before going into all of that, the first step is to upgrade the server, to
make sure that the exercise isn't a waste of time.

> the current version.

If that's the case, it should suggest to you that maildir isn't being actively
developed and support is likely to evaporate.

> If 4.5 CRAM-MD5 never worked, then I'm wasting my
> time.

Excuse me?  I understand your not wanting to waste your time, but what about
wasting the time of everyone else?

In the time that we've spent arguing about this, you could have brought up a
4.7a server temporarily to see if CRAM-MD5 works.  You probably could have
gotten maildir working in 4.7a.  Please consider one or the other of these
steps.

It's a stretch to imagine how the addition of a maildir driver could possibly
depend upon 4.5 vs. 4.7a.  The "patch" should be a maildir.h, a maildir.c, and
a couple of lines in the imap-4.[]/src/osdep/unix/Makefile.  All of this
should apply to 4.7a exactly as it does to 4.5.  If it involves anything else,
especially any modifications to any of the other program source files, then
it's possible that the bug is in that patch.

---

From: Dave Sill <[email-masked]>
Date: Tue, 15 Feb 2000 11:08:37 -0500 (EST)

>at best you'll only ever be able to get it to work in a half-hearted way.

I consider this an opportunity to either verify or refute the
conventional wisdom.

>completely false assumptions about IMAP loads based upon how (poorly) maildir

I'm not making any assumptions whatsoever. I'm trying to set up a
testbed so I can determine first-hand what what works and what
doesn't.

>If it wasn't already obvious, I don't know.

Confirmed: the 4.5 CRAM-MD5 doesn't work right under Solaris 7, GCC
2.8.1. I used the c-client/auth_md5.c from 4.7a and it worked fine.

>wasting the time of everyone else?

Nobody was compelled to "waste" their time answering my questions. I
came here hoping someone could tell me if the md5 in 4.5 should have
worked, and if so, how to debug it. I wasn't asking anyone to do the
work for me, I just didn't want to spend a lot of time diddling with
it unnecessarily. I certainly didn't intend to argue the pros and cons
of NFS and maildir, any more than I expected to defend my use of
qmail, Solaris, and GCC.

>gotten maildir working in 4.7a.  Please consider one or the other of these

And instead of arguing that maildir and NFS are bad and unnecessary,
you could have said right off the bat that you didn't know if the md5
in 4.5 worked.

Anyway, my immediate problem is solved. Thanks for your help.

-Dave