Re: smtp authentication fails

Ross wrote:
> On Mon, 3 Dec 2007, Marc Greene wrote:
>> Chris Wilson wrote:
>>> Hi Marc,
>>>
>>> On Mon, 3 Dec 2007, Marc Greene wrote:
>>>
>>>> Hi, I'm having trouble getting pine to authenticate properly to the
>>>> smtp server given by my email provider. The settings I was given
>>>> (copied from http://lavabit.com/settings.html) are:
>>> [...]
>>>> So, in my pine configuration settings, I have:
>>>>
>>>> user-domain = lavabit.com
>>>> smtp-server  = lavabit.com/user=marc
>>>>
>>>> In my .pinerc, I also have this:
>>>>
>>>> # List of SASL authenticators to disable.
>>>> disable-these-authenticators=
>>>>
>>>> The value is blank.
>>>>
>>>> Yet, when I try to send an email with these settings, I first get the
>>>> screen that says:
>>>>
>>>> There was a failure validating the SSL/TLS certificate for the server
>>>>                 lavabit.com
>>>> The reason for the failure was
>>>>                 unable to get local issuer certificate (details)
>>> [...]
>>>> So I exit this, and am returned to the previous screen where it gives
>>>> me the option to continue sending the message anyway, but when I
>>>> do this it gives me this error:
>>>>
>>>> Error sending: Can not authenticate to SMTP server: 501 Invalid
>>>> AUTH command.
>>> Probably Pine is refusing to use SSL because it can't verify the
>>> certificate, and tries to authenticate without SSL, which lavabit
refuses.
>>>
>>> Try adding /ssl/novalidate-cert to your smtp-server. It's less secure
>>> (risk of password theft if the remote server is spoofed) but may get
>>> things working for you.
>>>
>>> Cheers, Chris
>> Thanks for the reply Chris. I tried using the following variations in my
>> smtp-server setting:
>>
>> smtp-server = lavabit.com/ssl/novalidate-cert/user=marc
>> smtp-server = lavabit.com:465/ssl/novalidate-cert/user=marc
>>
>> Both still give me the same 501 Invalid AUTH command error, so I don't
>> think that's the issue. Plus the lavabit settings page clearly states
that
>> the server supports the LOGIN and PLAIN authentication methods, and
>> I'm able to send out mail with thunderbird without using SSL.
>>
>> I wonder if or how thunderbird is able to validate the certificate, and
>> at least send out mail through lavabit.com, and why pine can't.
>
> I doubt Pine is the problem or Thunderbird is validating any
> certificate. However, if Thunderbird is validating the certificate,
> the certificate has been loaded into Thunderbird, whether you know
> it or not - Windoozz does that.

Well I think you're right, because I'm using thunderbird with linux,
not windows, and I never manually loaded any certificates into it.
Thunderbird seems to be able to send mail without needing to
validate the certificate (with or without using SSL).

> It may be necessary to manually download the certificate for Pine to
> find in a local directory. It is also possible the certificate is
> not correctly written, using something other than "lavabit.com". I
> once suffered the problem until I realized the provided smtp-server
> system setup info did not match the certificate. Pine needs specific
> smtp-server name to validate - double check certificate! Is the
> certificate created with a prefix domain name "xxxx.lavabit.com"
> or something?

I'm don't know where I would manually download the certificate, or
where I should put it so pine can find it. I tried using mail.lavabit.com,
and smtp.lavabit.com, but they just give me the same error.

>
> Immediately add debug to get a readout of what might be happening, &
> simplify. Avoid SSL/TLS or any port numbers at first. If successful,
> build up in stages.
>
> lavabit.com/debug
> lavabit.com/novalidate-cert/debug
> lavabit.com/user=marc/debug
> lavabit.com/user=marc/novalidate-cert/debug

I tried this, but I don't know where pine writes the debug info to.
(.pine-debug?) I assume that I have to run pine with the -d flag,
but when I do that, pine tells me:

Argument Error: unknown flag "d", debugging not compiled in

Do I need to recompile pine with debugging for using dubug in my
smtp-sever setting?

> Also try to force POP3, as that appears to be an option:
>
> lavabit.com/POP3/debug

When I do this, the server doesn't respond, and after a couple of
minutes, pine asks me if I want to break the connection.

I read on http://lavabit.com/history.html that they wrote their own
mail server. I'm wondering if it is somehow tailored to only a few
MUAs. Maybe there is some difference in how pine and thunderbird
negotiate authentication, and the server just doesn't like the way
pine is doing it. All I can do is guess at this point.

Thanks for the response though!

Marc Greene


_______________________________________________
Pine-info mailing list
[email protected]
http://mailman1.u.washington.edu/mailman/listinfo/pine-info