bugThe nmh Mail Handling System - Bugs: bug #23168, post -sasl doesn't honour username...

 
 

bug #23168: post -sasl doesn't honour username in .netrc

Submitted by:  Peter Maydell <pm215>
Submitted on:  Sun 04 May 2008 06:03:38 PM UTC  
 
Category: BugSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Assigned to: NoneOpen/Closed: Closed

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 14 Apr 2013 03:00:35 PM UTC, comment #3:

After further thought, I fixed this, commit 52a236230220232fd632b5aa88eb9bb31dba346e. The existing behavior remains the default. But by adding a "credentials" entry to your profile, you can select behavior that honours the username in the .netrc. And, the .netrc filename can be any valid filename. See the credentials entry in the mh-profile(5) man page for details.

David Levine <levine>
Project Member
Mon 01 Apr 2013 02:49:09 AM UTC, comment #2:

I'm closing this for two reasons:
1) The tricky issue that Peter mentioned of not requesting the username when there's no .netrc, and
2) inc, msgchk, send, and post all have -user switches. It's so often necessary to use that if authentication is required, that it seems best just to rely on it for the login name.

David Levine <levine>
Project Member
Mon 20 Jul 2009 02:15:13 AM UTC, comment #1:

I am not sure if this issue is related: it seems nmh does not hornor not only .netrc but anything that mentions username.
See:

zhangweiwu@casablanca:~$ cat .netrc
cat: .netrc: No such file or directory
zhangweiwu@casablanca:~$ inc -sasl -saslmech login -snoop
<--- +OK VFEmail.net ready.
---> CAPA
<--- +OK
---> AUTH LOGIN
<--- + VXNlcm5hbWU6
Password (gildororonar@mail-on.us:mail.vfemail.net):
---> emhhbmd3ZWl3dQ==
<--- + UGFzc3dvcmQ6
---> bWFpbC52ZmVtYWlsLm5ldA==
<--- -ERR Authentication failed.
---> QUIT
<--- +OK Logging out
-ERR Authentication failed.
inc: -ERR Authentication failed.
zhangweiwu@casablanca:~$ echo emhhbmd3ZWl3dQ== | base64 -d; echo
zhangweiwu
zhangweiwu@casablanca:~$

So you can see pop prompts for password of <gildororonar@mail-on.us>, and when user entered a password, it then tell server the username of current user instead of <gildororonar@mail-on.us>. In short nmh lied to user. This happens, as you can see, even when there is no .netrc

Zhang Weiwu <zhangweiwu>
Sun 04 May 2008 06:03:38 PM UTC, original submission:

If you have a .netrc with contents something like:
machine localhost login me password wombat

then
post ~/draft -watch -sasl -snoop
incorrectly sends the server the local username rather than the username 'me' specified in the .netrc. It does correctly get the password out of the .netrc.

This is because ruserpass() (which reads the .netrc) is only called from sm_get_pass(); sm_get_user() just uses the results of sm_auth_sasl()'s call to getusername().

Fixing this could be a bit tricky because if you call ruserpass() and you don't have a .netrc then it will prompt for both username and password, so anybody using an auth method where local username is OK and no password is required will suddenly be presented with a username/password dialog. Some thought required here.

Peter Maydell <pm215>
Project Administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by levine (Posted a comment)
  • -unavailable- added by zhangweiwu (would be glad to know if this project is still alive)
  • -unavailable- added by zhangweiwu (Posted a comment)
  • -unavailable- added by pm215 (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 14 Apr 2013 03:00:35 PM UTClevineStatusWont Fix=>Fixed
    Mon 01 Apr 2013 02:49:09 AM UTClevineStatusNone=>Wont Fix
      Open/ClosedOpen=>Closed
    Mon 20 Jul 2009 02:16:20 AM UTCzhangweiwuCarbon-Copy-=>Added -unavailable-
    Mon 29 Dec 2008 10:39:14 PM UTCpm215CategoryNone=>Bug

    Back to the top


    Powered by Savane 3.1-cleanup