Subject: Re: imap: How to avoid folder creation?

From: "Tomas Pospisek's Mailing Lists" <[email-masked]>
Date: Thu, 27 Feb 2003 10:49:10 +0100 (CET)

On Wed, 26 Feb 2003, Friedrich Lobenstock wrote:

> If the users can only have their INBOX on imap but not any other
> folders what do they gain from this change.

They can move mails back and forth to and from the server, which is
impossible with pop.
*t

--
-----------------------------------------------------------
         Tomas Pospisek
         SourcePole   -  Linux & Open Source Solutions
         http://sourcepole.ch
         Elestastrasse 18, 7310 Bad Ragaz, Switzerland
         Tel: +41 (81) 330 77 11
-----------------------------------------------------------

---

From: Mark Edwards <[email-masked]>
Date: Thu, 27 Feb 2003 02:01:59 -0800

Okay, I took this issue over to the Squirrelmail developer's list, and 
this is what I got out of them.  Squirrelmail does TLS, not SSL, and it 
does not support the STARTTLS command.  So, this would appear to make 
it incompatible with imapd, is that right?

imapd can do SSL on, say port 993, or it can do TLS with STARTTLS on 
port 143, right?  But TLS without STARTTLS is not supported?

--
Mark Edwards
San Francisco, CA

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Friedrich Lobenstock <[email-masked]>
Date: Thu, 27 Feb 2003 14:05:36 +0100

> port 143, right?  But TLS without STARTTLS is not supported?

TLS ... transport layer security is somehow an improved and
         standardized SSL ver. 3

Here an example with uw-imapd as server:

# openssl s_client -host MAILSERVER -port 993 -tls1 -no_ssl3 -no_ssl2
CONNECTED(00000003)
[...certificate stuff removed...]
---
No client certificate CA names sent
---
SSL handshake has read 995 bytes and written 278 bytes
---
New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA
Server public key is 1024 bit
SSL-Session:
     Protocol  : TLSv1
     Cipher    : DES-CBC3-SHA
     Session-ID: B6B5F2BA27ED3BF40161C7344AA9C98C296CC4D515FD110377E79C1225512D0C
     Session-ID-ctx:
     Master-Key: CAD03D32A7067DA57CB668CADCDB24AD86CCB3C705B5B3BB0E984970EB7B8CF3193E8A49B1ED10F72672CA9D408F40EC
     Key-Arg   : None
     Start Time: 1046350839
     Timeout   : 7200 (sec)
     Verify return code: 18 (self signed certificate)
---
* OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS AUTH=PLAIN AUTH=LOGIN] ........

PS: PLEASE do not reply to a mail from this list to start a new thread.
Next time compose a new mail. TIA.

-- 
MfG / Regards
Friedrich Lobenstock

---

From: Friedrich Lobenstock <[email-masked]>
Date: Thu, 27 Feb 2003 14:09:13 +0100

> They can move mails back and forth to and from the server, which is

What's the point if they can only upload mails to their inbox
but not create other folders as that's what the orginal poster
wants. IMO better stay with POP3, that's less confusion for the
users and change to IMAP when the server got more harddisk space
to be able to hold all user folders.

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock         FL226-RIPE             Internetservices
URL: http://www.fl.priv.at/                     Email: [email-masked]
____________________________________________________________________

---

From: "Tomas Pospisek's Mailing Lists" <[email-masked]>
Date: Thu, 27 Feb 2003 14:23:08 +0100 (CET)

> to be able to hold all user folders.

You can f.ex synchronize your folders between various workstations. Which
you can't with POP.
*t

---

From: Friedrich Lobenstock <[email-masked]>
Date: Thu, 27 Feb 2003 14:36:17 +0100

> You can f.ex synchronize your folders between various workstations. Which

YES you are right _folders_. BUT the orginal poster wanted only the
INBOX to be available to the users. They should not be able to create
other folders. And I say that only having a writeable INBOX (via imap)
does only bring confusion to the users. Mildly put that's "non-sense".

---

From: "Tomas Pospisek's Mailing Lists" <[email-masked]>
Date: Thu, 27 Feb 2003 18:06:58 +0100 (CET)

> does only bring confusion to the users. Mildly put that's "non-sense".

You missunderstand - you can synchronize _locations_. I can copy a message
from my inbox at home to the inbox at my provider and from there to the
inbox at work and vice versa. Which is useful, since the mail is
following you then and not the other way round. And since you can automate
that quite nicely you don't even have to spend any attention on it.
*t

---

From: "Erik Kangas, Ph.D." <[email-masked]>
Date: Thu, 27 Feb 2003 12:22:14 -0500 (EST)

> that quite nicely you don't even have to spend any attention on it.

I suppose an easy way to prevent the users from making / using folders
is to make sure that they do not have write permission to their root
folder path, if that is possible given you system and user usage requirements.

-Erik Kangas

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Erik Kangas, Ph.D. --- President of Lux Scientiae, Incorporated

Lux Scientiae:       1-800-441-6612        46 Central Street
FAX:                 1-413-332-0598        Somerville, Massachusetts
Cell:                1-617-596-9558        02143, United States of America
AOL Messenger:       "luxsci"

[email-masked]  ---  http://luxsci.com

---

From: Mark Crispin <[email-masked]>
Date: Thu, 27 Feb 2003 09:47:24 -0800 (PST)

On Thu, 27 Feb 2003, Mark Edwards wrote:
> does not support the STARTTLS command.

That is a meaningless statement.  TLS is used with a STARTTLS command on
the regular port; SSL is used with a separate port.  If you support TLS,
you use the STARTTLS command.

> port 143, right?

Correct.

More to the point, the client uses the legacy SSLv23_client_method when it
makes a port 993 connection, and uses the modern TLSv1_client_method when
negotiating a STARTTLS command on port 143.

If Squirrelmail does not do this, then it is broken.

> But TLS without STARTTLS is not supported?

Considering that there is no such thing, it isn't surprising that
something non-existant isn't supported.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.

---

From: Mark Edwards <[email-masked]>
Date: Thu, 27 Feb 2003 11:14:35 -0800

> # openssl s_client -host MAILSERVER -port 993 -tls1 -no_ssl3 -no_ssl2

So, are you saying that uw-imapd can use TLS on port 993?  I thought it 
only did SSL on dedicated ports.

--
Mark Edwards
San Francisco, CA

---

From: Mark Crispin <[email-masked]>
Date: Thu, 27 Feb 2003 11:16:45 -0800 (PST)

> only did SSL on dedicated ports.

I think that a TLSv1 client method may be able to talk to a SSLv23 server
method.  The opposite is definitely not true.

Nonetheless, that doesn't mean that a SSLv23 server method is TLS.  It's SSL.