Subject: Plaintext passwords, SSL and localhost (fwd)

From: Dirk-Willem van Gulik <[email-masked]>
Date: Tue, 1 Apr 2003 13:37:16 +0200 (CEST)

(This time to the right list) - Arguably disabling plaintext passwords for
non-SSL inbound TCP connections from the bad outside world is useful.

However - (local) tools such as Squirrelmail (www.squirrelmail.org) are
unable to do SSL on 993 outright or do an upgrade StartTLS on 143.

So somehow it would be nice to for example excempt inbound connections
from/to 127.0.0.1 from no-plaintext rule; whilst still enforcing it for
outside connection.

In order to get the best of both worlds I've found myself adding things
like this:

	...main(int argc )...
	.. rc reading, linkage.c....
	..
	if((argc>1)&&(strcmp(argv[argc-1],"-plaintextok")==0)) {
	        mail_parameters (NIL,SET_DISABLEPLAINTEXT,NIL);
        	argc --;
  	}
	..server_init()..

to the main() in imapd.c (with inetd.conf for the outbound differently
that inetd.conf for the 127.0.0.1 interface) or a INADDR_LOOPBACK==sin..
check to accomplish the same.

Are there any plans for such long term ? Would it help if I submit a patch
for the above - based on either a command line argument (i.e. which
one would set from inetd.conf) or a INADDR_LOOPBACK check ? Or do people
feel that every imap client should learn SSL as soon as possible ?

Cheers,

Dw.

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see:
 http://www.washington.edu/imap/imap-list.html
-----------------------------------------------------------------

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Ralf Utermann <[email-masked]>
Date: Wed, 2 Apr 2003 09:41:40 +0200

> unable to do SSL on 993 outright or do an upgrade StartTLS on 143.
we use Squirrelmail 1.2.11 over stunnel with imap. No problems. I think the
next stable version 1.4 is able to do SSL on it's own (RC2 is out).

-Ralf
-- 
        Ralf Utermann
_____________________________________________________________________
        Universität Augsburg, Institut für Physik   --   EDV-Betreuer
        Universitätsstr.1             
        D-86135 Augsburg                     Phone:  +49-821-598-3231
        SMTP: [email-masked]         Fax: -3411

---

From: Dirk-Willem van Gulik <[email-masked]>
Date: Wed, 2 Apr 2003 10:28:13 +0200 (CEST)

> next stable version 1.4 is able to do SSL on it's own (RC2 is out).

Aye - but without fairly significant connection cashing - SSL, even over a
loopback interface, is a bit of an expense; esp. when you need to setup
and tear down as often as SQ does (right now).

DW.

---

From: Mark Crispin <[email-masked]>
Date: Wed, 2 Apr 2003 06:17:01 -0800 (PST)

> and tear down as often as SQ does (right now).

If SSL is an expense for setup/tear down, then IMAP is even more of
expense.  IMAP is a very stateful protocol, and broken clients that
deliberately discard hard-won state are not going to be good for server
performance.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.

---

From: Ralf Utermann <[email-masked]>
Date: Wed, 2 Apr 2003 17:04:21 +0200

> deliberately discard hard-won state are not going to be good for server
Very true, as I see on our mailserver:( 
On the other hand a lot (most?) webmail gateways use imap to 
communicate and yes, they start a new imap for every user action, then
close it. They do (or have to do) other bad things as well, like 
keeping the users password or being written in php ;-)
Anyway, I needed to offer our users some webmail gateway and
Squirrelmail/stunnel seemed to be the best solution for us.

-Ralf

---

From: Mark Crispin <[email-masked]>
Date: Wed, 2 Apr 2003 07:12:53 -0800 (PST)

On Wed, 2 Apr 2003, Ralf Utermann wrote:
> close it.

True.  One of the main motivations that led to our developing WebPine was
to have a webmail system that didn't do that.

-- Mark --

---

From: Rich Graves <[email-masked]>
Date: Wed, 2 Apr 2003 10:34:41 -0500 (EST)

> to have a webmail system that didn't do that.

Is WebPine available?

Other open-source alternatives or optimizations include Prayer (a
from-scratch C reimplementation of WING, which appears defunct) and
pitt-imapproxy, a caching proxy that still scares me. Courier fans will 
find courier webmail much faster.

Unfortunately, once your users are hooked on the prettier features that the
much larger IMP (or Squirrelmail) community is able to provide, you can't
go back.

We are seeing a significant benefit from having IMP do cleartext, even with 
hardware SSL acceleration. I don't think the processing load of opening an 
IMAP mailbox and running SELECT INBOX compares with SSL -- provided that 
you're smart and use mbx format rather than unix mbox. What does kill you 
is disk I/O. Your server must have enough RAM to keep all active webmail 
users' inboxes in cache.
-- 
Rich Graves <[email-masked]>
UNet Systems Administrator

---

From: Mark Crispin <[email-masked]>
Date: Wed, 2 Apr 2003 07:52:04 -0800 (PST)

> Is WebPine available?

WebPine is not yet generally outside of UW.  Although it is deployed for our
users, it is still very much a work in progress.  I do not anything about
plans or timing for external availability, but it's not imminent.