Subject: [Imap-uw] Launchcd script for imap/pop?

From: Richard Bonomo <[email-masked]>
Date: Fri, 28 Oct 2005 16:42:10 -0500 (CDT)

Hello!

I recently downloaded and installed 
the UWash imapd/popd package from
darwinports.  The install process
placed the binaries in /opt/local, but
it did not create a launch script.  

I tried producing one myself, but
when I try to telnet to the ports,
this happens:

[rich-mac1:~] bonomo% telnet localhost 110 
Trying ::1... 
Connected to localhost. 
Escape character is '^]'. 
launchproxy[13020]: execv(): Bad address 
Connection closed by foreign host. 

and 

[rich-mac1:~] bonomo% telnet localhost 143 
Trying ::1... 
Connected to localhost. 
Escape character is '^]'. 
launchproxy[13177]: execv(): Bad address 
Connection closed by foreign host. 

Has anyone run across this before, or have
an idea of the problem?

FWIW, this is the launch script I am currently
using for imap; the pop script is similar. (I 
would not be surprised if 
a script problem is the source of the trouble):

prompt% cat  edu.washington.imap.plist

******* begin file list
<?xml version="1.0" encoding="UTF-8"?> 

<dict> 
<key>Disabled</key> 
<false/> 
<key>Label</key> 
<string>imapd</string> 
<key>OnDemand</key> 
<false/> 
<key>ProgramArguments</key> 

<string>/opt/local/libexec/imapd</string> 

<key>Sockets</key> 
<dict> 
<key>Listeners</key> 
<dict> 
<key>Bonjour</key> 
<false/> 
<key>SockServiceName</key> 
<string>imap</string> 
<key>SockType</key> 
<string>stream</string> 
</dict> 
</dict> 
<key>inetdCompatibility</key> 
<dict> 
<key>Wait</key> 
<false/> 
</dict> 
</dict> 
</plist> 
******** end file list

The daemons *ARE* listening to the ports.

BTW, does either daemon make use of
hosts.allow?  I am assuming they do,
at the moment.

Rich
 
-- 
************************************************
Richard Bonomo
UW Space Astronomy Laboratory
ph: (608) 263-4683 telefacsimile: (608) 263-0361
SAL-related email: [email-masked]
all other email: [email-masked]
web page URL: http://www.cae.wisc.edu/~bonomo
************************************************

_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Mark Crispin <[email-masked]>
Date: Fri, 28 Oct 2005 16:19:29 -0700 (Pacific Daylight Time)

The first thing is that the ipop[23]d and imapd daemons do *NOT* listen on 
the ports; they just do stdio.  The listener is either inetd, xinetd, or 
launchd.

Since the daemons do not listen, they don't do any hosts.allow processing 
either.  That is done entirely by TCP wrappers, inetd, xinetd, or launchd 
depending upon how your system is setup.

In your case, the answer is probably "launchd".

I can't vouch for any third-party distributions. Have you tried obtaining 
the software directly from the UW FTP server on:
 	ftp://ftp.cac.washington.edu/mail/imap.tar.Z
and then building using the command:
 	make oxp

For what it's worth, I have a Mac Mini at home and run the servers using 
xinetd instead of launchd.  I didn't want to be bothered to learn how to 
use launchd; it's enough effort to keep track of inetd and xinetd.

However, someone once sent me a launchd script that he claimed works for 
imapd.  I haven't looked to see how it differs from yours.

<plist version="1.0">
   <dict>
 	<key>Disabled</key>
 	<false/>
 	<key>Label</key>
 	<string>imap4</string>
 	<key>ProgramArguments</key>
 	<array>
 	  <string>/usr/local/libexec/imaps</string>
 	</array>
 	<key>inetdCompatibility</key>
 	<dict>
 	  <key>Wait</key>
 	  <false/>
 	</dict>
 	<key>Sockets</key>
 	<dict>
 	  <key>Listeners</key>
 	  <dict>
 		<key>SockServiceName</key>
 		<string>imaps</string>
 		<key>Bonjour</key>
 		<false/>
 	  </dict>
 	</dict>
   </dict>
</plist>

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: Richard Bonomo <[email-masked]>
Date: Sat, 29 Oct 2005 16:53:45 -0500 (CDT)

Dear Mark,

Replies interleaved with your message, below:

> the ports; they just do stdio.  The listener is either inetd, xinetd, or 

Now that is something I did not know.  That explains why they
would not "listen" on the ports even when I started them manually.

Question: do pop2 and pop3 both have to be started, or is one
or the other optional to have POP working?

> depending upon how your system is setup.

OK, but the service labels used in hosts.allow would be (if
any) things like imap, pop, etc., not xinetd and launchd, no?
 
> In your case, the answer is probably "launchd".

Correct, though I might be able to use xinetd if need be.
 
> and then building using the command:

Actually, I thought that it was the very same thing.
 
> use launchd; it's enough effort to keep track of inetd and xinetd.

It does appear to be some Byzantine in structure and usage.
 
>  		<key>SockServiceName</key>

This did the trick, as far as startup goes!

I find that imap refuses to accept my login, and pop3 does
not appear to be doing anything.  Do both of these rely on 
pam.d?

Rich

---

From: Mark Crispin <[email-masked]>
Date: Sat, 29 Oct 2005 17:05:32 -0700 (PDT)

> or the other optional to have POP working?

For most sites, only ipop3d is needed since POP2 clients are an endangered 
species (albeit not utterly extinct).

> any) things like imap, pop, etc., not xinetd and launchd, no?

I would imagine so.  You would need to read the man page for whatever it 
is that does hosts.allow processing.  I'm don't know what does hosts.allow 
processing on Mac OS X, if anything does.

> Actually, I thought that it was the very same thing.

As I said, I can't vouch for any third-party distributions.  When in 
doubt, get the official version.

> not appear to be doing anything.  Do both of these rely on

Yes, they both use PAM, so you'll have to set up something in /etc/pam.d. 
I just copied /etc/pam.d/ftpd to /etc/pam.d/imap and /etc/pam.d/pop (note 
that the file name is "pop", not "pop3").

Also, by default, the servers do not permit password authentication unless 
either SSL or TLS encryption is in effect; this follows the requirements 
of RFC 3501.  So you probably need to set up SSL server certificates. 
Read the document in the BUILD and SSLBUILD files for more information.

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Richard Bonomo <[email-masked]>
Date: Wed, 2 Nov 2005 15:53:47 -0600 (CST)

Dear Mark,

Still trying!

I produced and installed a certificat, and, after googling,
even added a /etc/c-client file with a
set disable-plaintext 0
line, but imap is refusing to accept my login,
and pop3 is not even recognizing the "login" command.

I am going to remove and re-install from orginal
sources as you had suggested earlier, and I'll let
you know what happens.

Rich

On Sat, 29 Oct 2005, Mark Crispin wrote:

> I would imagine so.  You would need to read the man page for whatever it is 
> that does hosts.allow processing.  I'm don't know what does hosts.allow 
> As I said, I can't vouch for any third-party distributions.  When in doubt, 
> get the official version.
>
> Yes, they both use PAM, so you'll have to set up something in /etc/pam.d. I 
> just copied /etc/pam.d/ftpd to /etc/pam.d/imap and /etc/pam.d/pop (note that 
> the file name is "pop", not "pop3").
>
> either SSL or TLS encryption is in effect; this follows the requirements of 
> RFC 3501.  So you probably need to set up SSL server certificates. Read the 
> document in the BUILD and SSLBUILD files for more information.
>
> -- Mark --
>
> http://panda.com/mrc

---

From: Mark Crispin <[email-masked]>
Date: Wed, 2 Nov 2005 14:20:17 -0800 (Pacific Standard Time)

If you still have problems and are willing to let me log in to your 
system, I can look around and see what the problem is.  9 times out of 10 
it's something simple.

-- Mark --

---

From: Richard Bonomo <[email-masked]>
Date: Wed, 2 Nov 2005 16:22:18 -0600 (CST)

Thanks!

I'll let you know...

Rich

On Wed, 2 Nov 2005, Mark Crispin wrote:

> If you still have problems and are willing to let me log in to your system, I 
> can look around and see what the problem is.  9 times out of 10 it's 
> something simple.
>
> -- Mark --
>

---

From: Richard Bonomo <[email-masked]>
Date: Wed, 2 Nov 2005 16:49:28 -0600 (CST)

Dear Mark,

Logins are still failing.
Unless I have a bright idea overnight, I will probably take
you up on your offer tomorrow.

Rich

---

From: Mark Crispin <[email-masked]>
Date: Wed, 2 Nov 2005 14:55:25 -0800 (Pacific Standard Time)

> you up on your offer tomorrow.

Quick thing for you to check.  When you get the greeting banner from 
imapd, does LOGINDISABLED show up in the list of capabilities?  That is, 
do you see something like:

* OK [CAPABILITY IMAP4REV1 LITERAL+ SASL-IR LOGIN-REFERRALS STARTTLS LOGINDISABLED] imap.example.com IMAP4rev1 2005.362 at Wed, 2 Nov 2005 14:53:26 -0800 (PST)

If so, then you haven't successfully overcome the "no password 
authentication in non-SSL/TLS sessions" facility.

-- Mark --

---

From: Richard Bonomo <[email-masked]>
Date: Thu, 3 Nov 2005 10:45:28 -0600 (CST)

Dear Mark,

Here is what I get (anonymized a bit for the list):

first, for imap:
[<prompt>:~] bonomo% grep imap /etc/services
imap            143/udp     # Internet Message Access Protocol
imap            143/tcp     # Internet Message Access Protocol
imap3           220/udp     # Interactive Mail Access Protocol v3
imap3           220/tcp     # Interactive Mail Access Protocol v3
imap4-ssl       585/udp     # IMAP4+SSL (use 993 instead)
imap4-ssl       585/tcp     # IMAP4+SSL (use 993 instead)
imaps           993/udp     # imap4 protocol over TLS/SSL
imaps           993/tcp     # imap4 protocol over TLS/SSL
[<prompt>:~] bonomo% telnet <host.domain> 143
Trying 144.92.179.82...
Connected to <host.domain>.
Escape character is '^]'.
* OK [CAPABILITY IMAP4REV1 LITERAL+ SASL-IR LOGIN-REFERRALS AUTH=LOGIN] 
<host.domain> IMAP4rev1 2004.357 at Thu, 3 Nov 2005 10:31:29 
-0600 (CST)
a01 login bonomo
a01 BAD Missing or invalid argument to LOGIN
a02 login bonomo <password>
a02 NO LOGIN failed
a03 logout
* BYE <host-domain> IMAP4rev1 server terminating connection
a03 OK LOGOUT completed
Connection closed by foreign host.

then pop3:
[<prompt>:~] bonomo% grep pop /etc/services
##########      106        Unauthorized use by insecure poppassd protocol
pop2            109/udp     # Post Office Protocol - Version 2
pop2            109/tcp     # Post Office Protocol - Version 2
pop3            110/udp     # Post Office Protocol - Version 3
pop3            110/tcp     # Post Office Protocol - Version 3
hybrid-pop      473/udp     # hybrid-pop
hybrid-pop      473/tcp     # hybrid-pop
pop3s           995/udp     # pop3 protocol over TLS/SSL (was spop3)
pop3s           995/tcp     # pop3 protocol over TLS/SSL (was spop3)
[<prompt>:~] bonomo% telnet <host.domain> 110
Trying <IP number>...
Connected to <host.domain>.
Escape character is '^]'.
+OK POP3 <host.domain> 2004.89 server ready
user bonomo
+OK User name accepted, password please
pass <password>
-ERR Bad login
quit
+OK Sayonara
Connection closed by foreign host.
[<prompt>:~] bonomo%

system.log shows:

Nov  3 10:32:09 Richard-Bonomos-Computer imapd[28968]: Login failed 
user=bonomo auth=bonomo host=<host.domain> [<IP number>]
Nov  3 10:37:03 Richard-Bonomos-Computer ipop3d[28976]: Login failed 
user=bonomo auth=bonomo host=<host.domain> [<IP number>]

What do you make of it?

Rich

On Wed, 2 Nov 2005, Mark Crispin wrote:

> Quick thing for you to check.  When you get the greeting banner from imapd, 
> does LOGINDISABLED show up in the list of capabilities?  That is, do you see 
> something like:
>
> * OK [CAPABILITY IMAP4REV1 LITERAL+ SASL-IR LOGIN-REFERRALS STARTTLS 
> LOGINDISABLED] imap.example.com IMAP4rev1 2005.362 at Wed, 2 Nov 2005 
> 14:53:26 -0800 (PST)
>
> If so, then you haven't successfully overcome the "no password authentication 
> in non-SSL/TLS sessions" facility.
>
> -- Mark --
>

---

From: Richard Bonomo <[email-masked]>
Date: Thu, 3 Nov 2005 11:28:16 -0600 (CST)

Dear Mark,

I achieved a partial victory:  I changed the name
of the entry in /etc/pam.d from imapd to imap
(to match the name of the service in /etc/services),
and that got imap working.  Making a parallel
change for the pop3 server did not help.  For some
reason that service is still rejecting my password.

Rich

---

From: Mark Crispin <[email-masked]>
Date: Thu, 3 Nov 2005 10:02:10 -0800 (PST)

> reason that service is still rejecting my password.

OK, the problem is your PAM configuration.

Did you see in my original message about the proper names for the PAM 
files?  To remind you, they should be /etc/pam.d/imap and /etc/pam.d/pop

-- Mark --

http://panda.com/mrc

---

From: Richard Bonomo <[email-masked]>
Date: Thu, 3 Nov 2005 12:52:34 -0600 (CST)

Indeed, you had made that note in your
message of Oct. 29.  Needless to say it
fell out of my consciousness as I dealt
with the other issues, but probably
stimulated me in a subliminal fashion to
examine it again before declaring defeat.

Thank you for all your assistance!

Rich

On Thu, 3 Nov 2005, Mark Crispin wrote:

> Did you see in my original message about the proper names for the PAM files? 
> To remind you, they should be /etc/pam.d/imap and /etc/pam.d/pop
>
>
> -- Mark --
>
> http://panda.com/mrc

"A tyranny of the majority is still a tyranny."

---

From: Shawn Walker <[email-masked]>
Date: Thu, 03 Nov 2005 21:44:01 -0600

I have a message that seems "confused" from c-client. I have tried it 
with Pine 4.64 and it shows the message blank (empty).

I have provided the detail information below.  What we are doing is that 
we don't download the entire message.  We fetch the body structure and 
then we retrieve the body of the message later using the part number. 
According to the body struture, the "TEXT" "PLAIN" is part 1 and 
"INLINE" is part 2.  But, c-client is returning the data reversed (from 
what I can gather).

How do I determine the correct part number when I need to get the message?

I use mail_fetch_overview_sequence() to get the BODYSTRUCTURE:

BODYSTRUCTURE (("TEXT" "PLAIN" ("CHARSET" "us-ascii") NIL NIL "7BIT" 0 0 
NIL NIL NIL) "MIXED" ("BOUNDARY" "------------090003040805030408020409") 
("INLINE" ("FILENAME" "[Fwd: Re: a message]")) NIL) BODY[HEADER.FIELDS 
(Newsgroups Content-Disposition Content-Language Content-Location 
X-Priority Received)] {3884}

The actual raw email looks similar to this:

Date: Fri, 28 Oct 2005 20:33:27 +0200
From: User Example <[email-masked]>
To: [email-masked]
Subject: [Fwd: Re: a message]

This is a multi-part message in MIME format.
--------------090003040805030408020409
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: 7bit

-- 
User Example

--------------090003040805030408020409
Content-Type: message/rfc822;
  name="Re: a message"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
  filename="Re: a message"

Reply-To: "Some User" <[email-masked]>
Date: Fri, 28 Oct 2005 11:50:37 -0500
From: Some User <[email-masked]>
Subject: RE: a message
To: Some User <[email-masked]>

A sample message

--------------090003040805030408020409--

---

From: Mark Crispin <[email-masked]>
Date: Thu, 3 Nov 2005 21:43:32 -0800 (PST)

On Thu, 3 Nov 2005, Shawn Walker wrote:
> I have a message that seems "confused" from c-client. I have tried it with 
> Pine 4.64 and it shows the message blank (empty).

Are you using an IMAP server?  If so, what IMAP server implementation?

> ("INLINE" ("FILENAME" "[Fwd: Re: a message]")) NIL)

That BODYSTRUCTURE is completely bogus.  Here is the correct BODYSTRUCTURE 
for that message:

BODYSTRUCTURE (("TEXT" "PLAIN" ("CHARSET" "ISO-8859-15" "FORMAT" 
"flowed") NIL NIL "7BIT" 23 4 NIL NIL NIL NIL)("MESSAGE" "RFC822" ("NAME" 
"Re: a message") NIL NIL "7BIT" 518 ("Fri, 28 Oct 2005 11:50:37 -0500" 
"RE: a message" (("Some User" NIL "someuser" "example.net")) (("Some User" 
NIL "someuser" "example.net")) (("Some User" NIL "someuser" 
"example.net")) (("Some User" NIL "someuser" "example.net")) NIL NIL NIL 
"<[email-masked]>") ("TEXT" "PLAIN" ("CHARSET" 
"UTF-8" "FORMAT" "flowed") NIL NIL "7BIT" 18 1 NIL NIL NIL NIL) 15 NIL 
("INLINE" ("FILENAME" "Re: a message")) NIL NIL) "MIXED" ("BOUNDARY" 
"------------090003040805030408020409") NIL NIL NIL)

> I use mail_fetch_overview_sequence() to get the BODYSTRUCTURE:

mail_fetch_overview_sequence() is not the correct function to get a 
BODYSTRUCTURE.  The correct (and ONLY) function is mail_fetch_structure(). 
In general, overviews should be used only for NNTP and not for other types 
of connections.

What's more, how did you get that bogus "BODYSTRUCTURE"?  I hope that you 
didn't look at elt->private.msg.body; that data is strictly private to 
c-client (hence the "private" moniker) and it is guaranteed that 
applications will fail if they poke in there.

To repeat (since this is important): the ONLY way to get the message 
BODYSTRUCTURE is the mail_fetch_structure() function.

> According to 
> the body struture, the "TEXT" "PLAIN" is part 1 and "INLINE" is part 2.

What you quoted as a "BODYSTRUCTURE" only shows a single part with empty 
content.  The "INLINE" is a content disposition for the MULTIPART which is 
wrong because in the message it's the content disposition for an embedded 
message.  As I said, it's completely bogus.

I can't otherwise tell if it's just a matter of bad usage of c-client or 
if your IMAP server is also broken.

-- Mark --

http://panda.com/mrc

---

From: Shawn Walker <[email-masked]>
Date: Fri, 04 Nov 2005 11:47:23 -0600

The BODYSTRUCTURE is coming from a Cyrus IMAP4 v2.2.10 server.  Here is 
the body structure that c-client from calling mm_dlog() from the server.

* 1 FETCH (FLAGS (\Recent \Seen) INTERNALDATE " 4-Nov-2005 09:33:22 
-0600" RFC822.SIZE 1770 BODYSTRUCTURE (("TEXT" "PLAIN" ("CHARSET" 
"us-ascii") NIL NIL "7BIT" 0 0 NIL NIL NIL) "MIXED" ("BOUNDARY" 
"------------090003040805030408020409") ("INLINE" ("FILENAME" "Re: a 
message")) NIL))

I'm not using elt->private.msg.body, using "BODY".

Shawn

Mark Crispin wrote:
>> BODYSTRUCTURE (("TEXT" "PLAIN" ("CHARSET" "us-ascii") NIL NIL "7BIT" 0 
>> 0 NIL NIL NIL) "MIXED" ("BOUNDARY" 
>> "------------090003040805030408020409") ("INLINE" ("FILENAME" "[Fwd: 
>> Re: a message]")) NIL)
> 
> That BODYSTRUCTURE is completely bogus.  Here is the correct 
> BODYSTRUCTURE for that message:
> 
> "flowed") NIL NIL "7BIT" 23 4 NIL NIL NIL NIL)("MESSAGE" "RFC822" 
> ("NAME" "Re: a message") NIL NIL "7BIT" 518 ("Fri, 28 Oct 2005 11:50:37 
> -0500" "RE: a message" (("Some User" NIL "someuser" "example.net")) 
> (("Some User" NIL "someuser" "example.net")) (("Some User" NIL 
> "someuser" "example.net")) (("Some User" NIL "someuser" "example.net")) 
> NIL NIL NIL "<[email-masked]>") ("TEXT" "PLAIN" 
> ("CHARSET" "UTF-8" "FORMAT" "flowed") NIL NIL "7BIT" 18 1 NIL NIL NIL 
> NIL) 15 NIL ("INLINE" ("FILENAME" "Re: a message")) NIL NIL) "MIXED" 
> ("BOUNDARY" "------------090003040805030408020409") NIL NIL NIL)
> 
> BODYSTRUCTURE.  The correct (and ONLY) function is 
> mail_fetch_structure(). In general, overviews should be used only for 
> NNTP and not for other types of connections.
> 
> What's more, how did you get that bogus "BODYSTRUCTURE"?  I hope that 
> you didn't look at elt->private.msg.body; that data is strictly private 
> to c-client (hence the "private" moniker) and it is guaranteed that 
>> "INLINE" is part 2.
> content.  The "INLINE" is a content disposition for the MULTIPART which 
> is wrong because in the message it's the content disposition for an 
> embedded message.  As I said, it's completely bogus.
>

---

From: Mark Crispin <[email-masked]>
Date: Fri, 4 Nov 2005 09:50:15 -0800 (PST)

If you represented both the message and its BODYSTRUCTURE accurately, then 
you may have discovered a bug in Cyrus and you should report it to the 
Cyrus developers.

That BODYSTRUCTURE is definitely not for the message that you gave.

On Fri, 4 Nov 2005, Shawn Walker wrote:
> The BODYSTRUCTURE is coming from a Cyrus IMAP4 v2.2.10 server.  Here is the 
> body structure that c-client from calling mm_dlog() from the server.
>
> * 1 FETCH (FLAGS (\Recent \Seen) INTERNALDATE " 4-Nov-2005 09:33:22 -0600" 
> RFC822.SIZE 1770 BODYSTRUCTURE (("TEXT" "PLAIN" ("CHARSET" "us-ascii") NIL 
> NIL "7BIT" 0 0 NIL NIL NIL) "MIXED" ("BOUNDARY" 
>> BODYSTRUCTURE (("TEXT" "PLAIN" ("CHARSET" "ISO-8859-15" "FORMAT" "flowed") 
>> NIL NIL "7BIT" 23 4 NIL NIL NIL NIL)("MESSAGE" "RFC822" ("NAME" "Re: a 
>> message") NIL NIL "7BIT" 518 ("Fri, 28 Oct 2005 11:50:37 -0500" "RE: a 
>> message" (("Some User" NIL "someuser" "example.net")) (("Some User" NIL 
>> (("Some User" NIL "someuser" "example.net")) NIL NIL NIL 
>>> According to the body struture, the "TEXT" "PLAIN" is part 1 and "INLINE" 
>>> is part 2.
>> 
>> I can't otherwise tell if it's just a matter of bad usage of c-client or if 
>> your IMAP server is also broken.
>> 
>> -- Mark --
>> 
>> http://panda.com/mrc

-- Mark --

http://panda.com/mrc