Re: smtp authentication fails

On Fri, 7 Dec 2007, Marc Greene wrote:
> > Thu, 6 Dec 2007 (10:50 -0800 UTC) Marc Greene wrote:
> > > On Thu, 6 Dec 2007, Ross wrote:
> > > > It may be necessary to manually download the certificate for Pine to
> > > > find in a local directory. It is also possible the certificate is
> > > > not correctly written, using something other than "lavabit.com". I
> > > > once suffered the problem until I realized the provided smtp-server
> > > > system setup info did not match the certificate. Pine needs specific
> > > > smtp-server name to validate - double check certificate! Is the
> > > > certificate created with a prefix name "xxxx.lavabit.com"
> > > > or something?
> > >
> > > I'm don't know where I would manually download the certificate, or
> > > where I should put it so pine can find it. I tried using mail.lavabit.com,
> > > and smtp.lavabit.com, but they just give me the same error.

>From the recent emails I see, obviously validation is mandatory on
lavabit - PLAIN don't work anymore than POP3 - bad setup options
offered by lavabit. Not a surprise!  & the certificate is still
missing as far as Pine is concerned. Not a surprise!

Possibly Thunderbird negotiated the PLAIN/LOGIN authentication
automatically by design - trying different options until finding
what worked as opposed to Pine not being setup to try different
authentication. Well, ok - I don't know what Pine ver. you run, but
it seems you went to a lot of trouble to activate three possible
MainMenu-Setup-Config entries available. I am not aware why
recompile was required for debug to activate, or the pinerc file
needed to be opened manually, however -

Pine generally only needs /debug added to the smtp-server entry in
MainMenu-Setup-Config. The debug output files show up whereever
pinerc is located. I am using Pine 4.64. Maybe there is something I
don't know about a Linux compile ver. You also located the debug
files to read, good! They explained a lot.

Also, Pine offers two MainMenu-Setup-Config entries for this:
1)	[X]  try-alternative-authentication-driver-first
AND;
2)	disable-these-authenticators     = <No Value Set>

You edited pinerc I guess to provide the second entry with PLAIN -
fine. The first option above, according to the associated help:

"... By default, Pine will attempt to connect to an IMAP server on
the normal IMAP service port (143), and if the server offers
"Transport Layer Security" (TLS) and Pine has been compiled with
encryption capability, then a secure (encrypted) session will be
negotiated."

"With this feature enabled, before connecting on the normal IMAP
port, Pine will first attempt to connect to an alternate IMAP
service port (993) used specifically for encrypted IMAP sessions via
the Secure Sockets Layer (SSL) method. If the SSL attempt fails,
Pine will then try the default behavior described in the previous
paragraph."

"TLS negotiation on the normal port is preferred, and supersedes the
use of SSL on port 993, but older servers may not provide TLS
support. This feature may be convenient when accessing IMAP servers
that do not support TLS, but do support SSL connections on port 993.
However, it is important to understand that with this feature
enabled, Pine will attempt to make a secure connection if that is
possible, but it will proceed to make an insecure connection if that
is the only option offered by the server, or if the Pine in question
has been built without encryption capability. ..."

This will cause Pine to negotiate secure port 993 SSL authentication
first, the LOGIN I suppose, then fall back as required. That may be
what was needed instead of the disable of PLAIN. But whatever works!

As for the certificate, you must find it, download it, & install it
into Linux if you want certification of who you are connected to, &
a few other features I guess. I don't believe Pine will deal with a
certificate online. It looks in the working directory with pinerc.

Ask Lavabit where the certificate is located for download(possibly
the godaddy ref I saw given). If you can find the certificate,
download it to the working or Pine program directory, where pinerc
exists. A revocation certificate may also be available. I run Pine
in one directory & work in another so I load Pine with a Windoozz
shortcut command line of:

"C:\Program Files\PC-Pine464\pine.exe" -p c:\...\system\pinerc

Your Linux setup options are different I am sure. This command-line
startup tells Pine to load from one directory & access pinerc from
another directory in the system. In my case the certificate is named
cacert.der, the revocation file crl.pem. I keep them in the
directory with the pinerc file. Yes I installed the cert into
Windoozz Internet Options Certificates. So maybe that helps Pine
find it. Provide Linux the access, however you do that. Linux must
offer a certificate repository for all the certs the system needs -
surely.

The certificate will not install into Pine, but into Linux/Windoozz
for Thunderbird anyway. But once found by Pine in the pinerc
directory, & you provide Pine MainMenu-Setup-Config smtp-server with
the correct smtp-server name & domain entry, it should work.

After the certificate is located & provided for Pine to find, for
any further problems, double check certificate info, inbox-path &
SMTP-server name, domain name, for any prefixes - xxxx.lavabit.com,
etc. If the certificate is written wrong compared to the system it
certifies, the correct server name or certificate entry must be
determined & corrected. An SSH access into lavabit may offer a clue
as to correct server name via the command prompt.

As the saying goes, "been there - done that." Hope this helps.

--
The Best to You & Yours,
RossARR
[email protected]
mrossarr.nixsyspaus.org/
---end-of-message---

Taxing a man's labor is involuntary servitude!  Slavery!  Freemen
keep all their compensation, all they work for! "A wise and frugal
government ... shall not take from the mouth of labor the bread it
has earned." -- Thomas Jefferson, (http://PatriotPost.US/fqd/)
http://mrossarr.nixsyspaus.org/taxincome.shtml
_______________________________________________
Pine-info mailing list
[email protected]
http://mailman1.u.washington.edu/mailman/listinfo/pine-info