Re: smtp authentication fails

On Sun, 9 Dec 2007, Ross wrote:

> On Fri, 7 Dec 2007, Marc Greene wrote:
>>> Thu, 6 Dec 2007 (10:50 -0800 UTC) Marc Greene wrote:
>>>> On Thu, 6 Dec 2007, Ross wrote:
>>>>> It may be necessary to manually download the certificate for Pine to
>>>>> find in a local directory. It is also possible the certificate is
>>>>> not correctly written, using something other than "lavabit.com". I
>>>>> once suffered the problem until I realized the provided smtp-server
>>>>> system setup info did not match the certificate. Pine needs specific
>>>>> smtp-server name to validate - double check certificate! Is the
>>>>> certificate created with a prefix name "xxxx.lavabit.com"
>>>>> or something?
>>>>
>>>> I'm don't know where I would manually download the certificate, or
>>>> where I should put it so pine can find it. I tried using mail.lavabit.com,
>>>> and smtp.lavabit.com, but they just give me the same error.
>
>> From the recent emails I see, obviously validation is mandatory on
> lavabit - PLAIN don't work anymore than POP3 - bad setup options
> offered by lavabit. Not a surprise!  & the certificate is still
> missing as far as Pine is concerned. Not a surprise!
>
> Possibly Thunderbird negotiated the PLAIN/LOGIN authentication
> automatically by design - trying different options until finding
> what worked as opposed to Pine not being setup to try different
> authentication. Well, ok - I don't know what Pine ver. you run, but
> it seems you went to a lot of trouble to activate three possible
> MainMenu-Setup-Config entries available. I am not aware why
> recompile was required for debug to activate, or the pinerc file
> needed to be opened manually, however -
>
> Pine generally only needs /debug added to the smtp-server entry in
> MainMenu-Setup-Config. The debug output files show up whereever
> pinerc is located. I am using Pine 4.64. Maybe there is something I
> don't know about a Linux compile ver. You also located the debug
> files to read, good! They explained a lot.

I'm using pine-4.64

With the build of pine I was using before, it didn't create any 
pine-debug files by simply adding /debug to my smtp-server 
configuration option. When I ran it with 'pine -d4', it gave me 
this error:

Argument Error: unknown flag "d", debugging not compiled in

I had to recompile pine and added this to the build options:

DEBUG="-g -DDEBUG"

After this it ran with the -d flag and started creating debug 
files. Most pine builds apparently have this turned on already.

>
> Also, Pine offers two MainMenu-Setup-Config entries for this:
> 1)	[X]  try-alternative-authentication-driver-first
> AND;
> 2)	disable-these-authenticators     = <No Value Set>
>

try-alternative-authentication-driver-first is in my 
MainMenu-Setup-Config, but disable-these-authenticators is not. 
I had to edit my .pinerc to access that.

> You edited pinerc I guess to provide the second entry with PLAIN -
> fine. The first option above, according to the associated help:
>
> "... By default, Pine will attempt to connect to an IMAP server on
> the normal IMAP service port (143), and if the server offers
> "Transport Layer Security" (TLS) and Pine has been compiled with
> encryption capability, then a secure (encrypted) session will be
> negotiated."
>
> "With this feature enabled, before connecting on the normal IMAP
> port, Pine will first attempt to connect to an alternate IMAP
> service port (993) used specifically for encrypted IMAP sessions via
> the Secure Sockets Layer (SSL) method. If the SSL attempt fails,
> Pine will then try the default behavior described in the previous
> paragraph."
>
> "TLS negotiation on the normal port is preferred, and supersedes the
> use of SSL on port 993, but older servers may not provide TLS
> support. This feature may be convenient when accessing IMAP servers
> that do not support TLS, but do support SSL connections on port 993.
> However, it is important to understand that with this feature
> enabled, Pine will attempt to make a secure connection if that is
> possible, but it will proceed to make an insecure connection if that
> is the only option offered by the server, or if the Pine in question
> has been built without encryption capability. ..."
>
> This will cause Pine to negotiate secure port 993 SSL authentication
> first, the LOGIN I suppose, then fall back as required. That may be
> what was needed instead of the disable of PLAIN. But whatever works!
>
> As for the certificate, you must find it, download it, & install it
> into Linux if you want certification of who you are connected to, &
> a few other features I guess. I don't believe Pine will deal with a
> certificate online. It looks in the working directory with pinerc.
>
> Ask Lavabit where the certificate is located for download(possibly
> the godaddy ref I saw given). If you can find the certificate,
> download it to the working or Pine program directory, where pinerc
> exists. A revocation certificate may also be available. I run Pine
> in one directory & work in another so I load Pine with a Windoozz
> shortcut command line of:
>
> "C:\Program Files\PC-Pine464\pine.exe" -p c:\...\system\pinerc
>
> Your Linux setup options are different I am sure. This command-line
> startup tells Pine to load from one directory & access pinerc from
> another directory in the system. In my case the certificate is named
> cacert.der, the revocation file crl.pem. I keep them in the
> directory with the pinerc file. Yes I installed the cert into
> Windoozz Internet Options Certificates. So maybe that helps Pine
> find it. Provide Linux the access, however you do that. Linux must
> offer a certificate repository for all the certs the system needs -
> surely.

Yeah, on my system it is /etc/ssl/certs. I'm not trying to 
connect via IMAP with pine, I retrieve mail using fetchmail. 
When I compiled pine I also passed it these build options:

/build  DEBUG="-g -DDEBUG"  SSLTYPE=unix 
SSLCERTS=/etc/ssl/certs  SSLINCLUDE=/usr/include/openssl 
SSLLIB=/usr/lib  slx

Even after I downloaded the certificate from godaddy.com and 
added it to my /etc/ssl/certs directory (and my ~ directory 
where .pinerc is), it still won't validate the certificate when 
I try to connect to the smtp server via ssl using the following 
settings:

smtp-server = lavabit.com/user=marc
smtp-server = lavabit.com:465/ssl/user=marc

According to http://lavabit.com/settings.html 465 is the SMTP 
over SSL port. In order to avoid the "cannot validate 
certificate" error, I have to add novalidate-cert to the 
setting. I have also tried using smtp.lavabit.com and 
mail.lavabit.com, all give the same results. The settings page 
say to use "lavabit.com", and that works with novalidate-cert, 
as well as within thunderbird (with or without SSL turned on).

> The certificate will not install into Pine, but into Linux/Windoozz
> for Thunderbird anyway. But once found by Pine in the pinerc
> directory, & you provide Pine MainMenu-Setup-Config smtp-server with
> the correct smtp-server name & domain entry, it should work.

Tell me about it :)

The pine compile output gave me this warning:

   File /etc/ssl/certs/factory.pem is missing
   This might indicate that CA certs did not get properly
   installed.  If you get certificate validation failures
   in Pine, this might be the reason for them.

I think that might be the problem, but I haven't been able to 
find out what factory.pem is or why it wasn't installed by 
openssl, I'm still looking into that.

> After the certificate is located & provided for Pine to find, for
> any further problems, double check certificate info, inbox-path &
> SMTP-server name, domain name, for any prefixes - xxxx.lavabit.com,
> etc. If the certificate is written wrong compared to the system it
> certifies, the correct server name or certificate entry must be
> determined & corrected. An SSH access into lavabit may offer a clue
> as to correct server name via the command prompt.

I don't have SSH access into lavabit, but like I said, I'm 
pretty dang sure "lavabit.com" is the correct server name to 
use.

>
> As the saying goes, "been there - done that." Hope this helps.
>

Thanks for the info.

Marc Greene


_______________________________________________
Pine-info mailing list
[email protected]
http://mailman1.u.washington.edu/mailman/listinfo/pine-info