bugThe nmh Mail Handling System - Bugs: bug #23168, post -sasl doesn't honour username...

 
 
Show feedback again

bug #23168: post -sasl doesn't honour username in .netrc

Submitted by:  Peter Maydell <pm215>
Submitted on:  Sun 04 May 2008 06:03:38 PM UTC  
 
Category: BugSeverity: 3 - Normal
Priority: 5 - NormalStatus: None
Assigned to: NoneOpen/Closed: Open

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 20 Jul 2009 02:15:13 AM UTC, comment #1:

I am not sure if this issue is related: it seems nmh does not hornor not only .netrc but anything that mentions username.
See:

zhangweiwu@casablanca:~$ cat .netrc
cat: .netrc: No such file or directory
zhangweiwu@casablanca:~$ inc -sasl -saslmech login -snoop
<--- +OK VFEmail.net ready.
---> CAPA
<--- +OK
---> AUTH LOGIN
<--- + VXNlcm5hbWU6
Password (gildororonar@mail-on.us:mail.vfemail.net):
---> emhhbmd3ZWl3dQ==
<--- + UGFzc3dvcmQ6
---> bWFpbC52ZmVtYWlsLm5ldA==
<--- -ERR Authentication failed.
---> QUIT
<--- +OK Logging out
-ERR Authentication failed.
inc: -ERR Authentication failed.
zhangweiwu@casablanca:~$ echo emhhbmd3ZWl3dQ== | base64 -d; echo
zhangweiwu
zhangweiwu@casablanca:~$

So you can see pop prompts for password of <gildororonar@mail-on.us>, and when user entered a password, it then tell server the username of current user instead of <gildororonar@mail-on.us>. In short nmh lied to user. This happens, as you can see, even when there is no .netrc

Zhang Weiwu <zhangweiwu>
Sun 04 May 2008 06:03:38 PM UTC, original submission:

If you have a .netrc with contents something like:
machine localhost login me password wombat

then
post ~/draft -watch -sasl -snoop
incorrectly sends the server the local username rather than the username 'me' specified in the .netrc. It does correctly get the password out of the .netrc.

This is because ruserpass() (which reads the .netrc) is only called from sm_get_pass(); sm_get_user() just uses the results of sm_auth_sasl()'s call to getusername().

Fixing this could be a bit tricky because if you call ruserpass() and you don't have a .netrc then it will prompt for both username and password, so anybody using an auth method where local username is OK and no password is required will suddenly be presented with a username/password dialog. Some thought required here.

Peter Maydell <pm215>
Project Administrator

 

(Note: upload size limit is set to 512 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by zhangweiwu (would be glad to know if this project is still alive)
  • -unavailable- added by zhangweiwu (Posted a comment)
  • -unavailable- added by pm215 (Submitted the item)
  •  

    Please enter 421 here (basic anti-spam test):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 20 Jul 2009 02:16:20 AM UTCzhangweiwuCarbon-Copy-=>Added -unavailable-
    Mon 29 Dec 2008 10:39:14 PM UTCpm215CategoryNone=>Bug
    Show feedback again

    Back to the top


    Powered by Savane 3.1-cleanup