Re: net.post-office, how to avoid clear-text password?

>>>>> "cn" == Christian Nybø <[email protected]> writes:

  cn> I use the post-office functions to get my mail, and I wonder how
  cn> other users of the library go about securing their password when
  cn> using it for imap. Currently I tunnel through ssh, but it's a
  cn> hassle to open and close the tunnel, so using SSL would be
  cn> nicer. Has anyone tried that?

I haven't used the net.post-office package, but I have played around
with secure IMAP connections, using my SSL library for CMUCL. There
are two approaches to this: using IMAPS and using STARTTLS.

The IMAPS approach involves connecting to a special port (993) and
doing TLS negociation upon establishment of the connection. Presumably
the Allegro SSL support (SSL:MAKE-SSL-CLIENT-STREAM) can be used for
this.

The disadvantage of the IMAPS approach, from a networking perspective,
is that it requires a dedicated second port for the secure version of
the protocol; if you consider all the other network protocols that may
require a secure version, this leads to a doubling of the number of
reserved ports.

The alternative that is being pushed by the IETF is the STARTTLS
extension (RFC 2595 when associated with IMAP). In this approach, the
client connects to the standard IMAP port, and asks the server whether
it supports STARTTLS (by using the CAPABILITY command for IMAP, or by
looking at the list of ESMTP extensions for SMTP etc). If yes, the
client can initiate TLS negociation by issuing the STARTTLS command;
all further exchanges are secure. 

This is a little more difficult to achieve from a Lisp point of view,
because it implies transforming a normal network stream into an SSL
stream. In CMUCL, the networking functions return an FD-STREAM, where
the beginning of the IMAP conversation takes place. Switching to
secure mode means flushing the buffers of the FD-STREAM, disabling it
_without closing the underlying file descriptor_, and using
SSL:MAKE-SSL-CLIENT-STREAM with the file descriptor. The "disabling
without closing" business is necessarily implementation-specific; I
don't know how you'd go about doing that in ACL. I can send you my
code for CMUCL if you like.


I should point out that Allegro's SSL package is missing an important
piece of functionality: it does not (as far as I can tell from the
documentation) allow the client to verify the server's certificate.
This is necessary in order to protect the client against
man-in-the-middle type attacks. I am in the process of implementing
this for my CMUCL package, but it is made quite painful by the
complexity of the OpenSSL interface.
  
-- 
Eric Marsden                          <URL:http://www.laas.fr/~emarsden/>