gmane.mail.popa3d.user

Re: rate limiting popa3d

Solar Designer — 2008-09-27T03:31:22

You can achieve similar rate limiting, per source IP address rather than per username, using the MAX_SESSIONS_PER_SOURCE and MIN_DELAY settings in popa3d's params.h. These only have effect when running popa3d as a standalone server, not via inetd. popa3d assumes that sessions are "active" for at least MIN_DELAY seconds for the purpose of counting the number of "simultaneous" sessions. The default settings of MAX_SESSIONS_PER_SOURCE = 50 and MIN_DELAY = 10 are quite relaxed, allowing, in theory, for up to 5 sessions per second, on average, to be started from the same source address. (Since some of the sessions will likely have non-negligible duration, only a smaller number of sessions per second, on average, will be allowed in practice.) You can try changing these settings to, say, MAX_SESSIONS_PER_SOURCE = 5 and MIN_DELAY = 120, which won't allow sessions to be started more often than 5 in 120 seconds (2 minutes). Unfortunately, I am not aware of equivalent functionality in an inetd clone. xinetd's p

rate limiting popa3d

Wouter Callewaert — 2008-09-26T09:35:25

Dear all, Lately, our popa3d based pop server suffers from people checking their mail every 5 seconds. Is there a way to rate limit pop checking (based on username / time period for example) with popa3d or should I use a proxy pop3 server for this? If someone has a patch for this, that would be very helpful. Cheers, Wouter Callewaert

Re: denying certain system users from checking for mail

Solar Designer — 2008-08-08T20:59:35

This makes sense. There are two primary ways to achieve this: 1. Build popa3d with PAM support (provided that your system uses PAM) and use a PAM module such as pam_listfile. 2. Patch popa3d, such as with "popa3d 0.4 /etc/pop3.{allow,deny} support patch, by Lukasz Luzar" as listed on the popa3d homepage. Yes, this patch is for version 0.4, but it should not be difficult to forward-port to current versions. Please note that blacklisting (a "deny" file/list) might be unreliable in the security sense (it might be fail-open), and the use of a whitelist (an "allow" file/list) is preferred. Also, please note that pure file-based allow/deny implementations might be fail-open even if you do use the "allow" file - that's because security of this approach depends on being able to find the "allow" file in the first place. If the file somehow disappears (or at least the program does not "see" it for whatever reason), everyone is allowed. With pam_listfile, you're able to specify that the file must be present, t

denying certain system users from checking for mail

TLD Popa3d — 2008-08-08T19:38:39

Is there a way with popa3d to do like a deny.users list or something? I'm just looking for a way to tighten down the system, to keep the script kiddies and such from even getting to an authentication stage in the mail check, for example when they use the news user, root user, etc. I want the username to have to be a valid user of the system, i.e. mail-retrieving user, before it will get to the authentication stage. TLD

Re: popa3d and virtual domains

Solar Designer — 2008-05-15T10:56:51

Hi Ed, On Thu, May 15, 2008 at 05:47:48PM +0800, CC wrote: Yes. In fact, you don't even need a patch for IP-based virtual domains. The patch is for name-based ones. No. I suggest that you search for "POP3 proxy" on Freshmeat and Google. Since many POP3 proxies are meant for end-users, and this is not what you need, you may want to add extra keywords, such as "server-side". If you put popa3d behind a proxy like that, you may need to increase popa3d's MAX_SESSIONS_PER_SOURCE setting, because all of your connections will be coming from a single IP address (that of the proxy). Hopefully, the proxy implements its own anti-DoS measures (OK, most don't...) If you like, we may help you set this up - including consideration of your specific needs, choice of existing POP3 proxy software or/and custom programming (maybe a rework of popa3d), testing, deployment, and maybe maintenance - as a paid service. Please let me know off-list if you're interested. Thanks,

popa3d and virtual domains

CC — 2008-05-15T09:47:48

Hi, As far as I can determine, popa3d (patched with the vname patch) will support local virtual domains (i.e. domain:). Is there a patch out there that can support external paths? (i.e. domain::)? So instead of popa3d retrieving mail from a local virtual server, it goes for another pop server (by relaying commands coming from and contents going to the client). Any clarifications appreciated. Ed

Re: patch: discarding domain if no virtual domains

Solar Designer — 2008-04-21T00:13:17

Thank you for contributing the patch. I've placed it in here (with a link to this message added as a comment before the actual patch): ftp://ftp.openwall.com/pub/projects/popa3d/contrib/patches/ I think that this is a bit too much of a special case to link to the patch from the popa3d homepage, and the patch is trivial. This is fine, but I'd use memcpy() here. strncpy() is almost never the right choice because of its weird semantics - NUL padding (which is slow), but no guaranteed NUL termination. Most of the time, when I write portable code, I use strncat() instead (not forgetting to set the first character of the target buffer to NUL and to subtract 1 from the buffer size). Thanks again, Alexander

patch: discarding domain if no virtual domains

2008-04-10T14:34:47

Hi, I'm moving from shared web-hosting to VPS where I'm setting up popa3d. I want to make the move as seamless for mail users as possible. The shared hosting uses cPanel software with builtin POP3 server, there full email address serves as POP3 login, there is also a note: | If your e-mail client has trouble using a < at > sign in the login, | you can use +, :, or % sign instead. The users have different localparts of POPable mailboxes, so I needn't virtual domains in popa3d. It's more convenient without virtual domains because of the KISS principle and because users can change their passwords if I specify /usr/bin/passwd as login shell. I want users to be able to continie to use full email addresses as POP3 logins, popa3d to just ignore domains in logins and to use localpart as the username. I wrote and tested a patch http://lena.kiev.ua/popa3d-1.0.2-nonvirtual.diff It seems to work OK. I also include the same patch below. Lena ----- *** pop_auth.c.oldMon Sep 9 14:07:48 2002 --- pop_auth.cThu Apr 10 00:

Re: Failed or refused to load /var/spool/mail/xxxx

Tiago Cruz — 2007-08-08T17:22:17

Alexander, On 8/7/07, Solar Designer public.gmane.org> wrote: Thanks for your suggestion. Some days ago, I really was double checked this problem, permissions of all path (/var/spool/mail/user), and I can't find the solution. So, I've compiled from source, using standalone and without any path. And works very well :-) So, I've opened a bug in Mandriva Bugzilla, please, look at this link maybe you can say some thing about... some patch that don't work with Mailbox (only Maildir)... http://qa.mandriva.com/show_bug.cgi?id=32270 Thanks!

Re: Failed or refused to load /var/spool/mail/xxxx

Solar Designer — 2007-08-08T02:30:15

Unfortunately, popa3d does not include any code to provide more verbose error messages. Whenever this error message is seen, the problem is almost always obvious; but it might not have been obvious for you. I suggest that you either check and double-check the things already suggested to you (for example, did you check all parent directory permissions? including the root directory?) or start popa3d under "strace -fF". With strace, you would get more than enough information.

Re: Failed or refused to load /var/spool/mail/xxxx

Tiago Cruz — 2007-07-30T15:42:19

Hello, On 7/29/07, Solar Designer public.gmane.org> wrote: I think not, it's a new mailbox... and I have 2 mailbox to do this test (tiagocruz and tiago) No, is too small... only test messages from a new postfix. tiagocruz owner and mail is grup, not permission to others. But I've tried with "chmo 777" too and not works... :-( Yep! Using "mails" all works very well :-( It's one VM that i've created to do this test.... Do you have any other idea? (how increase log messsage debug, for example?) Thanks!!

Re: Failed or refused to load /var/spool/mail/xxxx

Solar Designer — 2007-07-29T11:24:23

... This can be caused by several things, listed here in arbitrary order: 1. The mbox file is corrupt (e.g., doesn't start with "From "). 2. The mbox file is too large (exceeds popa3d's compile-time safety limits; I don't know what they are for the Mandriva package). Try emptying the file with "> /var/spool/mail/tiagocruz" in the shell. 3. File permissions are wrong on the mbox file itself or/and on one or more of the parent directories. Are you able to access the file when logged in as user tiagocruz? 4. Something is broken in the system software or hardware. There are too many possibilities here, but they are relatively unlikely.

Re: Failed or refused to load /var/spool/mail/xxxx

Stanislav — 2007-07-28T09:56:06

Am 28.07.2007 um 00:42 schrieb Tiago Cruz: Ola Tiago, are the permissions of /var/spool/mail/tiagocruz respective /var/spool/mail correct? Stanislav

Failed or refused to load /var/spool/mail/xxxx

Tiago Cruz — 2007-07-27T22:42:26

Hello guys, I'm trying to use the popa3d after some years without work with mailservers (I was working just with webservers on ISP provider). I'm using the popa3d-1.0.2-1mdv2007.0 package, the server is UP and listen on 110/tcp port, the postfix it's working and delivering messages on /var/spool/mail/user as well. This is the problem: $ telnet localhost 110 Trying 127.0.0.1... Connected to orochimaru (127.0.0.1). Escape character is '^]'. +OK user tiagocruz +OK pass 123456 -ERR Connection closed by foreign host. And this is the error on log: Jul 18 00:17:36 orochimaru popa3d[12995]: Authentication passed for tiagocruz -- [127.0.0.1] Jul 18 00:17:36 orochimaru popa3d[12995]: Failed or refused to load /var/spool/mail/tiagocruz I don't have Idea of how can I solve this problem... someone can help me? Thanks a lot!

setup on Linux behind DNAT (was: cannot get this to work)

Solar Designer — 2007-05-05T17:31:38

Matt, I'm afraid that you've posted this to the wrong list. Your question has almost nothing to do with popa3d; it is about general network services and routing setup on Linux. Since you appear to be setting this up on Openwall GNU/*/Linux (Owl), you should have posted the question to owl-users. I am responding on popa3d-users for now since the question was raised in here anyway, but you may want to move further discussion to owl-users (please include an adequate amount of context if you do). I've changed the Subject to be more descriptive. On Thu, May 03, 2007 at 12:49:37AM -0600, matt mix wrote: If you can connect "locally" (is that "telnet localhost 110"?) and "do a STAT" (is that USER ..., PASS ..., then STAT?), then you have no problem with the popa3d setup. Yes, your problem could be with routing or the like. No, it can't be with Postfix, which provides the SMTP service, not POP3. On Owl, the Postfix + popa3d setup should work almost out of the box - all you need to do is enable and start the

cannot get this to work

matt mix — 2007-05-03T06:49:37

Hello everyone I am going to just start off and say I am rather new to linux and this is truly my last resort. I have looked everywhere and tried quite a bit before asking for help and I appreciate any that you all can provide. I have been trying for a couple days now to successfully setup this popa3d server to receive emails. I am using the basic out of the box openwall configurations and I have modified the postfix main.cf file the best I can and created a test user. I am able to locally connect and do a STAT w/ no problem. I dont know if this is a routing issue or a configuration within the postfix config files or not. I have set my router to forward the traffic on port 110 that comes in on my dynamic dns that is managed by my router to the pop server. I have forwarded both udp and tcp traffic through iptables. iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 110 -j DNAT --to 192.168.1.153 iptables -A forwarding_rule -i $WAN -p tcp --dport 110 -d 192.168.1.153 -j ACCEPT an

Re: offtopic: SMTP server to accept faxes

Andrè Carstens — 2007-03-23T15:23:17

What is this? Andre Carstens. ----- Original Message ----- From: "Solar Designer" public.gmane.org> To: public.gmane.org> Sent: Friday, March 23, 2007 1:31 AM Subject: [popa3d-users] offtopic: SMTP server to accept faxes

offtopic: SMTP server to accept faxes

Solar Designer — 2007-03-22T23:31:53

Stephen, You've managed to post your message with a meaningless Subject. I've changed it on this response. I will also unsubscribe you from this mailing list because popa3d is obviously not what you need. The only reason why I am responding on the list is that the question is already in here. No further discussion of it should occur on the list. The response is below: On Thu, Mar 22, 2007 at 05:58:54PM -0400, RC9647-YDxpq3io04c< at >public.gmane.org wrote: You need your own SMTP server, not your own POP3 server (such as popa3d). Yes, you may set that up on your home network - or we can do it for you remotely if you have a spare computer for this that you'd boot off a CD, provided that you compensate for our time. Please e-mail me privately if interested.

Re: confirm subscribe to popa3d-users-ZwoEplunGu1jrUoiu81ncdBPR1lH4CV8< at >public.gmane.org

2007-03-22T21:58:54

I am looking to understand if this product can help me solve a problem. I just got a new Sharp Broadband fax. It can receive faxes from the Public Telephone Network and send it as a TIFF or PDF attachment to you in box. However it only supports mail accounts with no authentication or using the POP before SMTP authentication Method. Man providers have abandoned this method in recent months. I need to set up on my home network a solution that can receive this email from the fax and using a mail client or through some means forward it to my corporate or even my broadband providers mail neither of which support this authentication method. Will this tool or do you know of anyway to solve this delima? Please advise and feel free to call and discuss if you have any questions or comments. Stephen Cell 972-365-8752 ************************************** AOL now offers free email to everyone. Find out more about what's free from AOL at http://www.aol.com.

Re: undefined reference to `crypt'

Solar Designer — 2007-01-21T13:41:16

You've managed to misread the documentation (INSTALL) and the comment in the Makefile. glibc is an essential system component, your system would not even boot up without it - so it is not a question whether you have glibc installed. INSTALL says: "Possibly edit the Makefile (uncomment "-lcrypt" for Linux with glibc, ..." It means that you should do just that - uncomment a line in the Makefile. This is referring to: # Linux with glibc, FreeBSD, NetBSD #LIBS += -lcrypt So you need to edit it to be: # Linux with glibc, FreeBSD, NetBSD LIBS += -lcrypt

undefined reference to `crypt'

Michael Patrick — 2007-01-21T13:10:28

I am trying to install popa3d on a linux Fedora4 new installation and I am getting the following error: undefined reference to `crypt' I see in the Makefile file that it needs glibc installed, and I confirmed that it is. Any suggestions?