Subject: imapd directories

From: Martynas Buozis <[email-masked]>
Date: Tue, 01 Jul 2003 11:26:05 +0200

Hello

I need a help to find out what should I changed in 
src/osdep/unix/env_unix.c if I want IMAP folders and INBOX to be located 
not in user's home directory.

For example user martynas has home directory /home/martynas. But I would 
like INBOX and IMAP folders (sub folders) to be in /data/mail/martynas .

For INBOX it's clear - I changed sysinbox function to sprintf to tmp 
right values. But what should I change if I want home directory for IMAP 
folders to be different from the one you get with getpwnam ?

Sorry if this question was discussed earlier, but I was not able to find 
information about it.

Thank you in advance for your help.

-- 

With best regards
Martynas Buozis
UNIX Systems Administrator
FFAB Computer Engineering

-------------------------------------------------------------
Martynas Buozis            Texas Instruments Deutschland GmbH
Mail:  [email-masked]     Haggertystrasse 1
Phone: +49 8161 80 4506    85356 Freising
Fax:   +49 8161 80 3191    Germany

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Tue, 1 Jul 2003 06:37:22 -0700 (PDT)

> not in user's home directory.

The information you need is in file imap-2002d/docs/CONFIG.  Pay
particular example to example 2.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: Martynas Buozis <[email-masked]>
Date: Tue, 01 Jul 2003 16:20:38 +0200

Dear Mark

Thank you for your help. I read this document before posting mail. As I 
understood in example 2 is described how to use not home directory 
directly, but it's sub directory as location for IMAP folders. For 
example always point to /home/<user>/mail instead of /home/<user> in 
case if  *mailsubdir equals "mail". Am I wrong and my problem will be 
solved with "*mailsubdir = "/data/mail"" ? But in code I see, that :

if (mailsubdir) {
       char tmp[MAILTMPLEN];
       sprintf (tmp,"%s/%s",home,mailsubdir);
       myMailboxDir = cpystr (tmp);/* use pre-defined subdirectory of 
home */
     }

So it prints home, than mailsubdir. What if I want home to be different?

While reading docs/CONFIG I understood, that home directory should be 
changed in env_init() routine : "The most common
modifications are to env_init(), to modify the software's idea of the
home directory (which is used everywhere as the default directory)".

But, well, I am not very strong in C and there are so many various 
variables used there (home, myHomeDir, etc.) ... Also I saw, that 
getpwnam is used more than one tim before setting folders to pw->pw_dir, 
so this makes me confused. Will it be enough to change home dir location 
in one  place ?

I am trying to use now "static char *blackBoxDir = "/data/mail";" - as I 
understood it will do right thing. Alias it is also nut fully clear for 
me what is that blackBox and how properly setup it, because in 
docs/imaprc.txt under section 5 ("set black-box-directory <directory 
name>") there is written :

"In order to make this work without crashing, you must set another 
option which is not listed in this document."

And my new imapd is really crashing, so I am not sure, that setting 
blackBoxDir to "/data/mail" is working. It is not clear about which 
setting there is information in docs/imaprc.txt file.

So maybe you can help me to clarify these questions ? I will highly 
appreciate any comments about this matter.

Thank you in advance.

With best regards
Martynas

-- 

With best regards
Martynas Buozis

---

From: Mark Crispin <[email-masked]>
Date: Tue, 1 Jul 2003 07:30:40 -0700 (PDT)

If you want to use a directory different from the home directory, then
just rewrite routine mymailboxdir() to do what you want, e.g.

static char *mymailboxdir ()
{
  unsigned long flags;
  char *user = myusername_full (&flags);
				/* initialize if first time and logged in */
  if (!myMailboxDir && (flags & MU_LOGGEDIN)) {
    char tmp[MAILTMPLEN];
    sprintf (tmp,"/data/mail/%s",myusername ());
    myMailboxDir = cpystr (tmp);/* use subdirectory of /data/mail */
  }
  return myMailboxDir ? myMailboxDir : "";
}

Do not use the black box stuff.  It will not do what you want.

-- Mark --

---

From: Martynas Buozis <[email-masked]>
Date: Wed, 02 Jul 2003 12:21:49 +0200

Dear Mark

Thank you very much for your help. Alias imapd is still looking for IMAP 
folders in home directory (/home/martynas) instead of special directory 
(/data/mail/martynas) after I recompiled imapd with these changes. I can 
see this with truss command.

If you will have other ideas - please let me know. Thank you very much 
for your time and efforts.

Is there anywhere documented what is black box ?

With best regards
Martynas Buozis

---

From: Mark Crispin <[email-masked]>
Date: Wed, 2 Jul 2003 07:03:40 -0700 (PDT)

> see this with truss command.

Are you certain that you used the correct imapd binary?  It is very easy
to become confused and inadvertantly run the old binary if you have two
imapd binaries on the system -- it happens *very* frequently.

Nothing uses the home directory after making that change except for
looking up an MH format config file.

> Is there anywhere documented what is black box ?

You really do not want to use black box.

-- Mark --

---

From: Martynas Buozis <[email-masked]>
Date: Wed, 02 Jul 2003 17:00:17 +0200

Mark

> imapd binaries on the system -- it happens *very* frequently.

Yes, I am sure. After your mail I deleted ALL temporary files and 
directories I am using to compile imapd. Then I untared original 
distribution, applied changes you recommended, compiled whole package 
from 0, checked for running imapd programs, copied just compiled imapd 
to test directory and ensured, that empty in /etc/inetd.conf points to 
this imapd (an it is actually the only one on this development system - 
the one I am trying to compile), sent HUP signal to inetd.

Result is same. Truss output shows, that imapd is looking for files and 
directories only in /home/martynas. Nothing like chdir or stat for any 
files/dirs in /data/mail/martynas. Actually "grep data truss_output" is 
empty.

So now I am a little bit confused ... Sorry for this.

Do you have any opinion about possibility to make imapd use closedBox 
feature and ensure, that chroot will be done to correct directory in 
pw_login procedure ? Are there any "bad" experiences with closedBox 
(user's inbox is in same /data/mail/<user> directory) ?

Thank you again for your time and support.

With best regards
Martynas

---

From: Mark Crispin <[email-masked]>
Date: Wed, 2 Jul 2003 10:55:38 -0700 (PDT)

You must have done something wrong, because everything uses the name
returned from mymailboxdir().  The only way that a correctly modified
imapd could have done that is if the client explicitly asked for
/home/martynas.

Run imapd from the shell, and give the command:
	x list "" %

Do you see the files and directories in the home directory or in the
/data/mail directory?

You almost certainly do not want to use closedBox either.  closedBox does
not have anything to do with using an alternative directory, and there are
specific security issues with using chroot() that only an expert should
undertake.

-- Mark --

---

From: Martynas Buozis <[email-masked]>
Date: Thu, 03 Jul 2003 10:13:07 +0200

Mark

> Run imapd from the shell, and give the command:

{martynas@dev ~} /data/compile/imap-2002d/imapd/imapd
* PREAUTH [CAPABILITY IMAP4REV1 IDLE NAMESPACE MAILBOX-REFERRALS BINARY 
UNSELECT SCAN SORT THREAD=REFERENCES THREAD=ORDEREDSUBJECT MULTIAPPEND] 
Pre-authenticated user martynas dev IMAP4rev1 2003.338 at Thu, 3 Jul 
2003 10:03:55 +0200 (MEST)
x list "" %
* LIST (\NoInferiors) NIL INBOX
x OK LIST completed

> Do you see the files and directories in the home directory or in the

No. But I am sure there are IMAP folder files and directories in 
/data/mail/martynas.

mymailboxdir procedure is exactly same as you used in your earlier letter.

> specific security issues with using chroot() that only an expert should

Well, actually closed box is what I would like to use. There must be 
some recomendations how to use it if feature is available ?

Thank you again for your help.

With best regards
Martynas

---

From: Mark Crispin <[email-masked]>
Date: Thu, 3 Jul 2003 09:18:55 -0700 (PDT)

> * LIST (\NoInferiors) NIL INBOX

Are there files and/or directories in *both* the home directory and the
/data/mail directory?

Are you certain that your userid has access to the /data/mail directory?

Your sample shows it returning *nothing*, as if it is looking at a
non-existant directory (INBOX always exist).

> mymailboxdir procedure is exactly same as you used in your earlier letter.

I just typed that in off the top of my head.  I didn't try to test or
debug it.  You need to do that.  Run gdb on imapd, and see what name
mymailboxdir() actually builds and what kind of strings mailboxfile() puts
together for path names.

> some recomendations how to use it if feature is available ?

Start with reading many books about UNIX security and the risks of using
chroot().  Do Google searchs about "chroot jail".  While in Google, look
for historical reports of how FTP servers (and other servers) that use
chroot() have been cracked, and why many people consider chroot() to be
intrinsically dangerous.  [Hint: What is the meaning of a subdirectory
called "etc" of a chroot() directory?]

When you thoroughly understand all of this, then you may consider closed
box.  But even then I think that it's a bad idea.

-- Mark --

---

From: Martynas Buozis <[email-masked]>
Date: Mon, 07 Jul 2003 13:20:51 +0200

Hello

> Are there files and/or directories in *both* the home directory and the

Files are in both directories (home and /data/mail).

> Are you certain that your userid has access to the /data/mail directory?

Yes, I am sure.

> non-existant directory (INBOX always exist).

That's a point.

> mymailboxdir() actually builds and what kind of strings mailboxfile() puts

Well, sorry for misunderstanding - I thought it's a code already checked 
up in other environment.

After examining other parts of code I decided to go for changing 
env_init procedure and ensure, that myHomeDir will be set up to point 
not to real home dir, but /data/mail/<user>. Simply changed line

myHomeDir = cpystr (home);        /* set home directory */

to

sprintf (tmp,"/data/mail/%s",user);
myHomeDir = cpystr (tmp);

Do you see any possible problems about this ? This looks more satisfying 
for me as I want all mail and imap related files (including 
configuration files) to be located in that specific directory, not in 
real home directory.

I understand chroot problems quite well, but in that case what should I 
go for to ensure, that users will be able to see only files in 
/data/mail/<user> ? I found restrictBox value but after some sort of 
critics about blackBox and closedBox choices I am not sure if it can be 
what I would like to go for ?...

Thank you again for you patience and kind help.

With best regards
Martynas Buozis

---

From: Mark Crispin <[email-masked]>
Date: Mon, 7 Jul 2003 05:37:23 -0700 (PDT)

On Mon, 7 Jul 2003, Martynas Buozis wrote:
> not to real home dir, but /data/mail/<user>.

The entire reason why there are separate myhomedir() and mymailboxdir()
routines are to eliminate the need to do this.

> configuration files) to be located in that specific directory, not in

The only files which are in myhomedir() instead of mymailboxdir() are
those files which MUST be in the home directory.  So making that change
actually breaks something.

If you're having problems with your change to mymailboxdir(), then you
need to debug that change and get it working, rather than make unwise
changes elsewhere.

> what I would like to go for ?...

restrictBox is the correct thing to use.

But first you need to debug the mymailboxdir() change.  You don't want to
make things more complicated until you get the simple thing working.  The
problem is undoubtably some basic error that you made.  I suggest that you
follow my earlier suggestion of running imapd under gdb with breakpoints
set so you see what file path is being built by mailboxfile().

-- Mark --

---

From: Martynas Buozis <[email-masked]>
Date: Mon, 07 Jul 2003 16:25:18 +0200

Hi again

> actually breaks something.

Well ... Requirement to change default location of directories for mail 
services is caused by specific environment. It requires no files in home 
directory that are not tied with a specific services. So all usual home 
directory files, related with mail services, in this environment must 
exists not in home directory (including INBOX, .imaprc, .mailboxlist and 
etc.). Otherwise I would probably go for linking mailsubdir directory 
where would I like it to be and do not look for any deeper changes in code.

So what I am really looking for is to change home directory returned by 
  default in getpwnam() - not only IMAP folders directory. For other 
mail related services I am doing this too. So is it really a difference 
if ALL files will exists in /data/mail/<user> instead of directory, that 
is in /etc/passwd for a user ?

With best regards
Martynas