Re: APOP, SSL, and PAM

At 12:18 p -0700 10/18/2007, Randall Gellens didst inscribe upon an 
electronic papyrus:

>At 3:02 PM -0700 10/17/07, Walter Ian Kaye wrote:
>
>>  I just got this working (on FreeBSD 6.2). Whew!
>>
>>  I set up my system using the Vanemery.com qpopper page as a guide.
>
>I'm not familiar with that.  If you have suggestions for changes to 
>the Qpopper FAQ or the Administrators Guide, please send them in. 
>Sending a patch is always welcome.

Quickstart Guide - Qpopper on FreeBSD
http://www.vanemery.com/Protocols/POP/qpopper-bsd-howto.html

Of course neither one helped me solve my SSL certificate issues -- I 
kept getting signature error code 7. A friend pointed me to 
<http://www.rpatrick.com/tech/makecert/>; meanwhile I had been 
reading the FAQ on RapidSSL.com which spoke of invalid characters 
such as "," and "." -- I had those in the company name field, so I 
removed them when I followed the third set of instructions, and 
finally got a working certificate.

>>  I had originally put all my users into the APOP db, but that 
>>confused Qpopper when a PC user on OE tried to connect. So I 
>>deleted the PC users from the APOP db (leaving the Mac users in, 
>>since both Eudora and Mail.app do APOP), and that left me with a 
>>PAM error ("pam_authenticate returned 9").
>
>The default setting for 'clear-text-password' rejects attempts to 
>log in with username/password if the user exists in the APOP 
>database. Looking at the code, setting 'clear-text-password' to 
>'TLS' also does this, but I'm thinking this may be a bug. 
>Specifically, the code at pop_user.c line (line 256 in qpopper4.0.9) 
>should check for other values as well.

Yeah, my thinking was that a PC user should be able to, um, upgrade 
from Outlook to Eudora without requiring sysadmin help; that's why I 
put all the users into the APOP database.

Aside: the old hosting service, which registered the domain name as 
well, switched the DNS while I was sleeping. I awoke today to a call 
from my coworker saying that email wasn't working. Oy. Hopefully 
nothing was lost; thank goodness the mail system stores and retries. 
Everything's working now. :-)

-Walter