Subject: Pondering Future Project

From: J T Breitner <[email-masked]>
Date: Thu, 08 Mar 2001 16:00:20 EST

I've been charged with creating a virtual user scheme that doesn't rely upon
LDAP.  LDAP is mostly cool, and likely may solve this problem, but the customer is
flat against this "single point of failure for many machines many customers".  I
realize that this could be a lengthy and heated thread on its own, so I'd rather not
get into it.  Let's just suffice to say that LDAP is o-u-t.

The proposed scheme isn't anything magical, each domain has its own /etc/passwd
file.  Just experimenting over the course of an hour or two, I've managed to mangle
ipop3d into determinging the virtual domain, separating a login, properly
validating and retrieving mail.  The popserver setuids to a common user/group id, and all
mailboxes and directories are owned by the common "vuser" user/group.

While this is all cute, I don't see this kludge as a satisfactory method.  First,
it won't support POP AUTH LOGIN because the kludge isn't that sophisticated
(yet).  Furthermore, it seems that if it's to really fit into c-client, it needs to be
brought into it as an authenticator.  

My understanding of the IMAP server leads me to believe that running it as a
common user/group could be a tricky security situation since the user could
technically specify a directory other than their own if they knew the paths.

So am I correct in thinking that the proper way to fix the ipop3d server is to
create my own authenticator?  And also, does anyone have comments on the security
issues of the IMAP server using this authentication method and running as a common
"virtual user"?

Lastly, if creating an authenticator is the way to pull this off, any resources
about this other than internal.txt, source-code and a lot of caffeine?

Thanks...

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------