Subject: Re: webmail pop login problem

From: Lisa Bogue <[email-masked]>
Date: Fri, 3 Oct 2003 15:20:54 -0700 (PDT)

Thanks Mark-

It looks like you are correct.  It's a little troublesome in that the webmail 
advertises it's ability to use secure connections and I had configured the conf 
file to use secure connections.  Perhaps the new version will get it right.  

imap-2002e
# ./ipop3d
+OK POP3 v2003.83 server ready
CAPA
+OK Capability list follows:
TOP
LOGIN-DELAY 180
UIDL
STLS
SASL
.

imap-2002
+OK POP3 v2001.80 server ready
CAPA
+OK Capability list follows:
TOP
LOGIN-DELAY 180
UIDL
STLS
USER
SASL LOGIN
.

---

From: Mark Crispin <[email-masked]>
Date: Fri, 3 Oct 2003 15:41:30 -0700 (Pacific Daylight Time)

Hi Lisa -

If you would like to build the new version so that it permits password
authentication in insecure sessions, add "SSLTYPE=unix" to the make
command line (you'll have to do a "make clean" first).

By default, it is "SSLTYPE=nopwd".

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: "Chr. von Stuckrad" <[email-masked]>
Date: Sun, 5 Oct 2003 19:31:45 +0200

On Fri, Oct 03, 2003 at 03:20:54PM -0700, Lisa Bogue wrote:
> Thanks Mark-
> 
> It looks like you are correct.  It's a little troublesome in
> that the webmail advertises it's ability to use secure
> connections and I had configured the conf file to use secure
> connections.  Perhaps the new version will get it right.  

Perhaps it never was wrong?

IF ALL access to the mail goes over 'https:...' and is so
encrypted, and the connection between 'webmail' and 'imap'
is ABSOLUTELY ONLY on the 'localhost', you would not really
need to encrypt the imap-protocol between apache and uw_imap
on the localhost.

Then you only have to make sure not to allow access to
the unencrypted imap from the normal network interface.

I did that once by starting imapd with bernstein's tcptools
(binding only to localhost) and once by using the tcpwrappers
in imapd to drop every connection not coming from localhost.

If somebody 'sniff'es on the localhost, everything's lost
anyway :-)

Stucki  (postmaster at math/inf/mi.fu-berlin.de)

---

From: Mark Crispin <[email-masked]>
Date: Sun, 5 Oct 2003 10:42:15 -0700 (PDT)

> need to encrypt the imap-protocol between apache and uw_imap

I have been informed that it is *not* safe to assume that localhost is a
secure pipe; and that localhost *can* be sniffed.

I do not want imapd to be the center of attention of a security advisory
because of an ill-considered decision to exempt localhost from the
encryption rules.  There are still still flames about imapd being
"insecure" because of problems that were fixed 5 years ago.

-- Mark --

---

From: "Chr. von Stuckrad" <[email-masked]>
Date: Sun, 5 Oct 2003 20:11:44 +0200

> secure pipe; and that localhost *can* be sniffed.

OUTCH! If there can be casese of leaking Information
from 'localhost' to 'the outside', I'd have to change
lots of little things here... Can you give me a hint?

Or did you mean 'can be sniffed on the same host'
which of course is possible and might be a problem,
if users can run arbitrary programs in 'mailscripts'
like postscript or other filters on the same host.

I assumed in my reply, that the users hopefully may
only access via apache, so nobody would be able to
start anything unusual on the host itself.

> "insecure" because of problems that were fixed 5 years ago.

OH, I see, what you mean, but nobody should blame 'misuse'
or 'broken configs' to the 'program' (but to the 'installer').

That 'localhost'-problem would sound like flaming imap for
a break in the kernel of the system?

Stucki

---

From: Timo Sirainen <[email-masked]>
Date: Sun, 05 Oct 2003 23:22:04 +0300

> like postscript or other filters on the same host.

I'd like to know where and how this might be possible without root
privileges? Root can of course do whatever it wants. I really doubt
there's a way for non-root to do it in any sane operating system.

---

From: Mark Crispin <[email-masked]>
Date: Sun, 5 Oct 2003 14:07:48 -0700 (PDT)

> there's a way for non-root to do it in any sane operating system.

The UNIX world has a very bad history of giving assurances to software
developers that such-and-such can be relied upon, and then turning on
those developers for having the temerity to rely upon such-and-such.  The
open source portion of the UNIX world has been particularly bad in
undermining long-standing "you can count on this" assumptions.

I certainly agree that a sane operating system would not allow an
unprivileged user to sniff on a localhost session.  I would probably
consider such to be safe on my own personal system.

On the other hand, UNIX and its variants do numerous other things that I
do not consider to be the behavior of a sane operating system.  Thus, my
opinion of what constitutes the behavior of a sane operating system is not
useful in determining what will happen on UNIX.  *That* particular lesson
has been hammered home many times.

I have heard folklore to the effect that it is unsafe to assume that a
localhost session is a secure channel.  I am unable to find any sort of
standard or security document that purports otherwise and/or states that
developers can rely upon localhost being a secure channel.

The consequence of being excessively cautious is that localhost
connections use encryption unnecessarily unless the end user hacks the
code.  The consequences of misguided trust in the "concensus of experts"
are another trail of BUGTRAQ advisories, cracked systems, and years of
flames.

Please, feel free to do your own hacks to permit password authentication
in unencrypted localhost connections.  All you have to do is the following
two instructions:
   auth_pla.server = auth_plain_server;
   mail_parameters (NIL,SET_DISABLEPLAINTEXT,NIL);
in some strategic place early in the code.

-- Mark --