Re: smtp authentication fails

I was able to figure out the problem by first learning how the 
PLAIN and LOGIN authentication protocols worked, then manually 
authenticating via a telnet session, and also by recompiling 
pine with debugging turned on:

$ telnet lavabit.com 25
Trying 72.249.41.52...
Connected to lavabit.com.
Escape character is '^]'.
220 lavabit.com ESMTP lavad
ehlo riverstone.homelinux.org
250-lavabit.com
250-STARTTLS
250-PIPELINING
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250 Okay.
auth login
334 VXNlcm5hbWU6
bWFyYw==
334 UGFzc3dvcmQ6
XXXXXXXXXXX
235 Authenticated.

Then the .pine-debug1 file showed:

IMAP DEBUG 03:33:59 12/7: 220 lavabit.com ESMTP lavad
IMAP DEBUG 03:33:59 12/7: EHLO riverstone
IMAP DEBUG 03:33:59 12/7: 250-lavabit.com
IMAP DEBUG 03:33:59 12/7: 250-PIPELINING
IMAP DEBUG 03:33:59 12/7: 250-AUTH LOGIN PLAIN
IMAP DEBUG 03:33:59 12/7: 250-AUTH=LOGIN PLAIN
IMAP DEBUG 03:33:59 12/7: 250 Okay.
IMAP DEBUG 03:33:59 12/7: AUTH PLAIN
IMAP DEBUG 03:34:00 12/7: 501 Invalid AUTH command.
IMAP 03:34:00 12/7 mm_log error: Can not authenticate to SMTP server: 501 Invalid AUTH command.
IMAP DEBUG 03:34:00 12/7: QUIT
IMAP DEBUG 03:34:00 12/7: 221 Bye.
call_mailer ERROR: Error sending: Can not authenticate to SMTP server: 501 Invalid AUTH command.
Send failed, continuing

So it appears that even though the lavabit.com settings page states
that their server supports LOGIN and PLAIN authentication, and the
lavabit.com server advertises it, that the server really doesn't 
support PLAIN authentication, but only LOGIN. I was able to force 
pine into using LOGIN authentication by adding

disable-these-authenticators=PLAIN

to my .pinerc, and now it is able to send mail through lavabit.com.

Thanks to everyone who gave help :)

Marc Greene

On Thu, 6 Dec 2007, Marc Greene wrote:

> Ross wrote:
>> On Mon, 3 Dec 2007, Marc Greene wrote:
>>> Chris Wilson wrote:
>>>> Hi Marc,
>>>>
>>>> On Mon, 3 Dec 2007, Marc Greene wrote:
>>>>
>>>>> Hi, I'm having trouble getting pine to authenticate properly to the
>>>>> smtp server given by my email provider. The settings I was given
>>>>> (copied from http://lavabit.com/settings.html) are:
>>>> [...]
>>>>> So, in my pine configuration settings, I have:
>>>>>
>>>>> user-domain = lavabit.com
>>>>> smtp-server  = lavabit.com/user=marc
>>>>>
>>>>> In my .pinerc, I also have this:
>>>>>
>>>>> # List of SASL authenticators to disable.
>>>>> disable-these-authenticators=
>>>>>
>>>>> The value is blank.
>>>>>
>>>>> Yet, when I try to send an email with these settings, I first get the
>>>>> screen that says:
>>>>>
>>>>> There was a failure validating the SSL/TLS certificate for the server
>>>>>                 lavabit.com
>>>>> The reason for the failure was
>>>>>                 unable to get local issuer certificate (details)
>>>> [...]
>>>>> So I exit this, and am returned to the previous screen where it gives
>>>>> me the option to continue sending the message anyway, but when I
>>>>> do this it gives me this error:
>>>>>
>>>>> Error sending: Can not authenticate to SMTP server: 501 Invalid
>>>>> AUTH command.
>>>> Probably Pine is refusing to use SSL because it can't verify the
>>>> certificate, and tries to authenticate without SSL, which lavabit
> refuses.
>>>>
>>>> Try adding /ssl/novalidate-cert to your smtp-server. It's less secure
>>>> (risk of password theft if the remote server is spoofed) but may get
>>>> things working for you.
>>>>
>>>> Cheers, Chris
>>> Thanks for the reply Chris. I tried using the following variations in my
>>> smtp-server setting:
>>>
>>> smtp-server = lavabit.com/ssl/novalidate-cert/user=marc
>>> smtp-server = lavabit.com:465/ssl/novalidate-cert/user=marc
>>>
>>> Both still give me the same 501 Invalid AUTH command error, so I don't
>>> think that's the issue. Plus the lavabit settings page clearly states
> that
>>> the server supports the LOGIN and PLAIN authentication methods, and
>>> I'm able to send out mail with thunderbird without using SSL.
>>>
>>> I wonder if or how thunderbird is able to validate the certificate, and
>>> at least send out mail through lavabit.com, and why pine can't.
>>
>> I doubt Pine is the problem or Thunderbird is validating any
>> certificate. However, if Thunderbird is validating the certificate,
>> the certificate has been loaded into Thunderbird, whether you know
>> it or not - Windoozz does that.
>
> Well I think you're right, because I'm using thunderbird with linux,
> not windows, and I never manually loaded any certificates into it.
> Thunderbird seems to be able to send mail without needing to
> validate the certificate (with or without using SSL).
>
>> It may be necessary to manually download the certificate for Pine to
>> find in a local directory. It is also possible the certificate is
>> not correctly written, using something other than "lavabit.com". I
>> once suffered the problem until I realized the provided smtp-server
>> system setup info did not match the certificate. Pine needs specific
>> smtp-server name to validate - double check certificate! Is the
>> certificate created with a prefix domain name "xxxx.lavabit.com"
>> or something?
>
> I'm don't know where I would manually download the certificate, or
> where I should put it so pine can find it. I tried using mail.lavabit.com,
> and smtp.lavabit.com, but they just give me the same error.
>
>>
>> Immediately add debug to get a readout of what might be happening, &
>> simplify. Avoid SSL/TLS or any port numbers at first. If successful,
>> build up in stages.
>>
>> lavabit.com/debug
>> lavabit.com/novalidate-cert/debug
>> lavabit.com/user=marc/debug
>> lavabit.com/user=marc/novalidate-cert/debug
>
> I tried this, but I don't know where pine writes the debug info to.
> (.pine-debug?) I assume that I have to run pine with the -d flag,
> but when I do that, pine tells me:
>
> Argument Error: unknown flag "d", debugging not compiled in
>
> Do I need to recompile pine with debugging for using dubug in my
> smtp-sever setting?
>
>> Also try to force POP3, as that appears to be an option:
>>
>> lavabit.com/POP3/debug
>
> When I do this, the server doesn't respond, and after a couple of
> minutes, pine asks me if I want to break the connection.
>
> I read on http://lavabit.com/history.html that they wrote their own
> mail server. I'm wondering if it is somehow tailored to only a few
> MUAs. Maybe there is some difference in how pine and thunderbird
> negotiate authentication, and the server just doesn't like the way
> pine is doing it. All I can do is guess at this point.
>
> Thanks for the response though!
>
> Marc Greene

_______________________________________________
Pine-info mailing list
[email protected]
http://mailman1.u.washington.edu/mailman/listinfo/pine-info