Subject: how to configure ipop3d?

From: "Paul A. Thiessen" <[email-masked]>
Date: Mon, 1 Sep 2003 10:09:16 -0400

Hi! I just downloaded and figured out how to build your imap-2002d package.
Thanks for providing this! I'm trying to set up ipop3d to use as a POP->IMAP
relayer, so that I can access an IMAP server from my POP3 e-mail client -
that is what it's for, right? I'm not totally confused? ;)

I'm not sure how to configure it, though:

- How do I tell it what the name/address/port of my IMAP server is? I tried
changing myServerAddr and myServerHost in env_nt.c, but that didn't work.

- Do I need to hard-code in my username/password somehow (by changing the
global vars at the top of env_nt.c or ...?), or are those taken from the
username/password sent by the POP3 e-mail client?

- Do I need to use some form of POP3 authentication from my e-mail client?

- Does ipop3d need to cache e-mail messages somewhere, or is it a pure
"virtual client" in the sense that it just passes mail from IMAP server
directly to POP3 client?

Anyway, all I'm getting now are "ERR bad login" or "ERR bad authentication"
messages when I try to fetch e-mail. I'm using the UW inetlisn, which seems
to be working okay, as it looks like my e-mail client is actually connecting
to ipop3d. It's just obviously not making the connection to the server, not
sure why.

Any general hints on how to set this up would be appreciated! I'm not
planning to run a local IMAP server or anything, all I need is ipop3d.

 - Paul

-- 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   Paul A.   |        NCBI / NIH
  Thiessen   |  [email-masked]
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: "Paul A. Thiessen" <[email-masked]>
Date: Tue, 2 Sep 2003 10:35:29 -0400

On Monday, September 1, 2003, 10:09:16 AM, Paul A. Thiessen wrote:

PAT> I'm trying to set up ipop3d to use as a POP->IMAP relayer...

Well, after looking more at the code, I'm a bit discouraged. I'm using
Win2000, and I see in env_nt.c, in system_login(), the lines:

    if (check_nt ()) {          /* NT: authentication user not supported yet */
      if (authuser && *authuser);
      else if (!pass);          /* ditto pass==NIL */

From what I can tell, the pop->imap proxy seems to use anonymous_login(),
which uses a NIL pass argument to system_login(). Does that mean then that
relaying will never work under win2k?

If that's the case, is there something I can do to help enable this? Is it a
fundamental matter of the OS that makes this impossible, or is it just that
nobody's had time to implement it? I'll volunteer some time on this if
someone would give me a few general tips on how to make this work.

- Paul

---

From: Mark Crispin <[email-masked]>
Date: Tue, 2 Sep 2003 14:06:02 -0700 (Pacific Daylight Time)

On Mon, 1 Sep 2003, Paul A. Thiessen wrote:
> I'm trying to set up ipop3d to use as a POP->IMAP

ipop3d is a POP3 server which happens to have IMAP proxy capability as an
additional feature.  It will run on Windows NT, but was designed for UNIX
and it is recommended that you run it on UNIX instead of Windows.

> changing myServerAddr and myServerHost in env_nt.c, but that didn't work.

You don't.  If you plan on using the POP->IMAP proxy capability, the user
at the POP client uses a POP user name of the form:
	imapserver:imapuserid
and a POP password that's the same as the IMAP password.

For example, if the user's IMAP server is fred.nlm.nih.gov and the user's
userid is sally, the POP3 user name would be
	fred.nlm.nih.gov:sally

> username/password sent by the POP3 e-mail client?

This data is supplied by the client.

> - Do I need to use some form of POP3 authentication from my e-mail client?

Barring some additional programming effort, only plaintext password
authentication will work.  These days, people aren't doing much POP/IMAP
proxying.

> "virtual client" in the sense that it just passes mail from IMAP server

ipop3d is a "virtual client".

> messages when I try to fetch e-mail.

Is the "Guest" account defined on your Windows NT server with no password?

A preferable choice would be to run this on UNIX, in which case it uses
the system standard "nobody" account for daemons and doesn't need to have
the account be open.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: "Paul A. Thiessen" <[email-masked]>
Date: Tue, 2 Sep 2003 17:29:03 -0400

Thanks, Mark, for your help!

I discovered that I can make this work on my system by making the following
simple change (to :

imap-2002d> diff c-client/env_nt.c src/osdep/nt/env_nt.c
342c342
<       else if (!pass) return env_init (user,NIL);       /* ditto pass==NIL */
---
>       else if (!pass);                /* ditto pass==NIL */

Basically, this makes anonymous_login() work on win2k. I dunno how good a
general fix this is - what sort of security implications it has - but since
I'm using this only on my own personal laptop, not used by others, I'm not
too worried. (Should I be? I modeled this after the parallel code for
win9x...) I guess I don't understand this part of the code still - why any
sort of local "login" is required when no local files are being accessed.
What's the need for the Guest login during the proxy connection? (I'm not
too familiar with this part of windows os interaction.)

Anyway, now it's working. Thanks again for making this tool!

Yeah, I realize this is probably a rare use these days. :) Ironically, I
need this because my e-mail client (The Bat v2) now fully supports IMAP in
the "correct" remote mailbox file model (e.g., doesn't store mail locally),
and my server only supports IMAP. But on my laptop, I need to have mail
stored and accessible locally, since I'm not always on the network, and the
only way I could do this was to use The Bat as a POP client.

- Paul

On Tuesday, September 2, 2003, 10:35:29 AM, Paul A. Thiessen wrote:

PAT> On Monday, September 1, 2003, 10:09:16 AM, Paul A. Thiessen wrote:

PAT>> I'm trying to set up ipop3d to use as a POP->IMAP relayer...

PAT> Well, after looking more at the code, I'm a bit discouraged. I'm using
PAT> Win2000, and I see in env_nt.c, in system_login(), the lines:

PAT>     if (check_nt ()) {          /* NT: authentication user not supported yet */
PAT>       if (authuser && *authuser);
PAT>       else if (!pass);          /* ditto pass==NIL */

>>From what I can tell, the pop->imap proxy seems to use anonymous_login(),
PAT> which uses a NIL pass argument to system_login(). Does that mean then that
PAT> relaying will never work under win2k?

PAT> If that's the case, is there something I can do to help enable this? Is it a
PAT> fundamental matter of the OS that makes this impossible, or is it just that
PAT> nobody's had time to implement it? I'll volunteer some time on this if
PAT> someone would give me a few general tips on how to make this work.

PAT> - Paul

---

From: Mark Crispin <[email-masked]>
Date: Tue, 2 Sep 2003 15:13:11 -0700 (Pacific Daylight Time)

On Tue, 2 Sep 2003, Paul A. Thiessen wrote:
> I dunno how good a
> too worried.

The problem is that the server on the Win2K machine will be running with
SYSTEM privileges.  The purpose of the Guest logon is to drop those
elevated privileges, so as to minimize the consequences if a bad guy
should find a way to corrupt the server.

Once again, it would be better to run this on UNIX, where the technology
is better defined/refined.

-- Mark --

---

From: "Paul A. Thiessen" <[email-masked]>
Date: Tue, 2 Sep 2003 18:34:46 -0400

MC> The problem is that the server on the Win2K machine will be running with
MC> SYSTEM privileges.  The purpose of the Guest logon is to drop those
MC> elevated privileges, so as to minimize the consequences if a bad guy
MC> should find a way to corrupt the server.

Okay, thanks for the explanation! I see, sort of... ;) Is it not possible to
drop these privileges under win2000, or has it just not been written into
system_login() yet for this platform? Or, why not make it possible to run
ipop3d as a "normal" user? I tried running it as this (just by starting it
up via normal command line), with same "USER host:user" format, but it
doesn't seem to work (ERR bad login) - I guess normal users don't have
access to the net sockets or something? Is there some other access
limitation that would make the proxy route not work with a normal-user
process? IOW, Why does ipop3d have to run as system in the first place when
only doing this proxying?

Anyway, I know UNIX would be better, but I don't have any choice but to run
it on Win2k - I don't have a UNIX server to set this up on... Even if I did,
my secure line to my IMAP server necessarily goes directly from my laptop
(port forwarding via SSH), so there's no way I could use another (UNIX)
machine inbetween there. (What's really happening is that I'm using ipop3d
to proxy e-mail from the local POP port to the local IMAP port.)

- Paul

---

From: Mark Crispin <[email-masked]>
Date: Tue, 2 Sep 2003 15:43:26 -0700 (Pacific Daylight Time)

On Tue, 2 Sep 2003, Paul A. Thiessen wrote:
> Is it not possible to
> system_login() yet for this platform?

That's exactly what logging in as Guest is supposed to do.

> Or, why not make it possible to run
> access to the net sockets or something?

Normal users can't log in as other users, not even if you know the
password.  It's how NT is designed.

> Why does ipop3d have to run as system in the first place when

It doesn't know that proxying is all it will do.

-- Mark --

---

From: "Paul A. Thiessen" <[email-masked]>
Date: Tue, 2 Sep 2003 19:04:27 -0400

>> system_login() yet for this platform?

MC> That's exactly what logging in as Guest is supposed to do.

I know, but my whole point is that as far as I can tell from reading the
code, as the imapd-2002d code currently stands this logging on as Guest in
ipop3d under win2000 will *never* work - that is, anonymous_login() will
*always* fail. Right? Hence my need to make some modification.

Let me see if I have this straight, correct me if I'm wrong: ipop3d.exe is
run as system so that when a user accesses the POP port and wants to look at
a local file, the privilege level gets set to that user's account, so that
they can't read others' mail but can access their own local inbox. But this
"local logon" seems to happen only after USER+PASS is received by the POP
server, with a request for a local INBOX. When the "USER host:user" format
is received, it logs on as Guest only, and forwards requests to the IMAP
host.

Is there any fundamental reason, then, why I couldn't run ipop3d under my
own account, and use it for proxying? If ipop3d is going to switch to Guest
(with minimal privileges) anyway, why couldn't I just run it via my normal
account, when I need to read mail (and not set the port listener up as a
system service)? I understand that it's not written this way because it's
normally used as a regular multi-user server. I'm just wondering if there's
any reason it couldn't be modified to be run under a normal user account.
Can normal user accounts access the net ports? Seems this is all that'd be
required to run in proxy mode, no local file access needed.

Or maybe you're saying this is still too insecure? That is, the reason Guest
is used is that it can't access anything at all, and the a normal-user
process can't switch to Guest under win2000?

Sorry to keep bugging you, I'm just trying to understand the philosophy of
how this access control is supposed to work... ;)

- Paul

---

From: Mark Crispin <[email-masked]>
Date: Tue, 2 Sep 2003 17:12:35 -0700 (Pacific Daylight Time)

> *always* fail. Right? Hence my need to make some modification.

Correct on all points.  This was never fully worked out.

> own account, and use it for proxying?

It's probably alright in a closed system, in which outsiders can't
communicate with it.  I'd be worried if it was on the open Internet.

-- Mark --