Subject: Disable namespaces, random browsing in imapd 4.5 ??

From: Andrew Daviel <[email-masked]>
Date: Fri, 26 Mar 1999 17:59:35 -0800 (PST)

I recently built imapd 4.5 on Linux and Irix, which we are intending to
use shortly with Netscape (4.5 ??) as our site email system, taking over
from telnet or POP3 to VMS.

We are learning as we go, making all the usual mistakes no doubt...

1. We felt that the namespace information which is negotiated by Netscape
is confusing and unnecessary for our normal users, particularly the
appearance of the anonymous ftp hierarchy and Usenet news as  folders,
and the appearance of some #mh folders was confusing for one user who had
some historic mh files in her home directory, until we figured out
(more-or-less) what was going on.  Is there any way to disable this
feature ?

2. While experimenting with the Netscape Messenger configuration (see
#3 below), I found I could set the "IMAP server directory" to "/"
and allow Netscape to browse the entire filesystem and potentially create
folders at random, such as in /tmp. This is not really a problem
on our application server, where everyone has real accounts and can
go clean up, but we are commissioning a mail server where users have
captive accounts (perhaps not the best way, but we understand it) and in
theory no access to the filesystem beyond their home directory.
Is there a way to restrict this kind of access ?
It seemed to me one could perhaps set the  black-box-directory parameter
in the imapd config file, except we are told  to never use this.
If all our users have home directories in "/home", would setting 
black-box-directory to "/home" somehow accomplish this ?

3. The default Netscape behaviour, with the default imapd behaviour,
seems to be to browse the users complete home directory to set up folders.
I first discovered I could set "IMAP server directory" in Netscape
Messenger to "mail", and later found the build notes saying I could edit
the source code to change this behaviour. I guess this item is taken care
of - I just took a while to find it.

4. Netscape has a checkbox for "Use SSL". Has anyone worked on SSLEAY or
similar software which would work with UW IMAPD and Netscape ?
Is there any compatible authenication mechanism between Netscape (Unix and
Win95) and IMAPD which would prevent passwords appearing in clear on the
network ?  We are trying to discourage this practice, especially on our 
application servers, since  we have on various occasions had hackers set
up Ethernet sniffers.

regards, Andrew

Deniable unless digitally signed
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376
http://andrew.triumf.ca/andrew 

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------