from:"Nick"


Greetings.

First, absolutely great package.  Thanks for all the work.

I'm trying to configure squirrelmail to talk via PAM and radius to a 
one-time password system.  I am using Cryus and postfix.


I have /etc/pam.d/imap pointed to the OTP server with 'sufficient' as 
the setting.  I can login with a password.  I can successfully the OTPs 
with

# testsaslauthd -u username -p onetimepasscodehere

and with

imtest -u username -a usernane -p onetimepasscodehere

I can successfully log into the imap server via Thunderbird using the 
OTP, but Squirrelmail seems to request validation of the OTP twice.  The 
first time, the OTP is validated.  The second time, it fails (for 
obvious reasons ;).


I've googled and FAQ'd all I can.  Anybody know why squirrelmail would 
be looking to authenticate twice?


thanks in advance,

nick


--
Nick Owen
WiKID Systems, Inc.
404.962.8983 (desk)
404.542.9453 (cell)
http://www.wikidsystems.com
At last, two-factor authentication, without the hassle factor
Now open source: http://sourceforge.net/projects/wikid-twofactor/


---
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] pam radius/OTP question

LOL, guess i should have put more thought into the architecture ;). Oh 
well, I didn't have much else to do today.


That being said, is there a way to cache the session credentials in 
apache or PHP?


Chris Hilts wrote:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Nick Owen wrote:


I'm trying to configure squirrelmail to talk via PAM and radius to a
one-time password system.  I am using Cryus and postfix.


Since every click generates a new login to the IMAP server (remember,
we're dealing with a web app here - each click is a new request..),
won't you run out of pregenerated OTP challenges pretty darn quick?

I don't believe OTP is feasible for webmail use.

- --
Chris Hilts
[EMAIL PROTECTED]
Say it with flowers -- Send them a triffid!
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.1 (MingW32)

iD8DBQFDx/7098ixrK2vMtARAvbaAJ9Jxmpttiky0WMdE56s4Y6H3CtnJgCfQs9m
qS44zqo9LENNpAxmVtl7Qxw=
=asvo
-END PGP SIGNATURE-


---
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users



--
Nick Owen
WiKID Systems, Inc.
404.962.8983 (desk)
404.542.9453 (cell)
http://www.wikidsystems.com
At last, two-factor authentication, without the hassle factor
Now open source: http://sourceforge.net/projects/wikid-twofactor/


---
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] pam radius/OTP question


Chris Hilts wrote:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Nick Owen wrote:

LOL, guess i should have put more thought into the architecture ;). Oh
well, I didn't have much else to do today.

That being said, is there a way to cache the session credentials in
apache or PHP?


Sure.. And in fact, that's exactly how our login system works.  PHP
remembers your username and (hashed) password in a session.  However,
that won't do much good for OTP, because, by it's very nature the OTP
token will be invalid for the next login even when cached.  Or have I
misunderstood what you're asking? (Wouldn't be the first time I've done
that..)


No, you understand, I'm just slow and not terribly specific.  Each click 
is a new login.  The creds are cached.  So, each request sends the 
cached creds to the authentication mechanism.  Is there a way to use a 
cached sessionid variable instead of using the creds without breaking 
the security model?   Is there a plugin that might do something like 
this? Or would we have to do a new plugin?


tia,

nick


---
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] pam radius/OTP question


Jeremy Shaffner wrote:

I don't usually reply to myself, but what about the IMAP proxy?

On 1/13/06 1:40 PM, "Jeremy Shaffner" <[EMAIL PROTECTED]> wrote:



There are a couple OTP implementations that allow for increasing the time a
password is good for (I've also been looking into RADIUS w/OTP for other
uses.)

I wonder if you could make an OPIE or S/Key calculator via Ajax that could
provide SM with the next password.  :)

On 1/13/06 1:33 PM, "Chris Hilts" <[EMAIL PROTECTED]> wrote:




Hey Jeremey.  Interesting idea. Let me dig into it.  Are you thinking of 
imapproxy.org or something else?


--
Nick Owen
WiKID Systems, Inc.
404.962.8983 (desk)
404.542.9453 (cell)
http://www.wikidsystems.com
At last, two-factor authentication, without the hassle factor
Now open source: http://sourceforge.net/projects/wikid-twofactor/


---
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] pam radius/OTP question

2006-01-16 Thread Nick Owen


Jeremy Shaffner wrote:


On 1/13/06 1:54 PM, "Nick Owen" <[EMAIL PROTECTED]> wrote:


Jeremy Shaffner wrote:

I don't usually reply to myself, but what about the IMAP proxy?


Hey Jeremey.  Interesting idea. Let me dig into it.  Are you thinking of
imapproxy.org or something else?


That's the one.


And it did the trick.  Thanks.  Works like a charm.



--
Nick Owen
WiKID Systems, Inc.
404.962.8983 (desk)
404.542.9453 (cell)
http://www.wikidsystems.com
At last, two-factor authentication, without the hassle factor
Now open source: http://sourceforge.net/projects/wikid-twofactor/



Wait, it's WiKID you're trying to use isn't it?  I didn't even catch that.
Write an Ajax client  :P.


How about a Firefox extension?  Would that be cool?  We'd have to think 
about the security of an AJAX client - key storage.


Nick


---
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Getting started.

2006-03-20 Thread Nick Owen

David wrote:
> Hi.  I have SM installed on my Linux FC4 dedicated server but I have no idea 
> how to link it to the 4 virtual domains I have on it.  Has anyone got the 
> time and the will to help me get setup.
> 
> What I want is all of my domains to use the webmail 
> www.mydomain.net/squirrelmail etc.
> 

David:

Check out how to set up virtual hosts on Apache, starting here:
http://httpd.apache.org/docs/2.0/vhosts/name-based.html

I'd give an example from mine, but I think that they are fairly specific
and might lead you in the wrong direction.

HTH,

nick

-- 
Nick Owen
WiKID Systems, Inc.
404.962.8983
http://www.wikidsystems.com
Commercial/Open Source Two-Factor Authentication
https://www.linkedin.com/in/nickowen


---
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Getting started.

2006-03-20 Thread Nick Owen

David wrote:
> I think all that is fine, the websites are working great.  I presume there is 
> a config file for SM to edit, I guess I just cant work it out, I thought it 
> might have relatively simple.  With Webmin installed I thought there might 
> have been a module called 'squirrelmail' or something but I cannot see 
> anything.
> 
> Thanks
> 
> David
> 
> 
> On Monday 20 March 2006 17:33, Nick Owen wrote:
> 
>> Check out how to set up virtual hosts on Apache, starting here:
>> http://httpd.apache.org/docs/2.0/vhosts/name-based.html
>>
>> I'd give an example from mine, but I think that they are fairly specific
>> and might lead you in the wrong direction.

So what happens when you browse to
http://www.servername.com/squirrelmail? How is your directory set up?
Do you have a squirrelmail directory set up in each of the website's
directories?

-- 
Nick Owen
WiKID Systems, Inc.
404.962.8983
http://www.wikidsystems.com
Commercial/Open Source Two-Factor Authentication
https://www.linkedin.com/in/nickowen


---
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] webmail+kerberos+cyrus imapd

2006-04-17 Thread Nick Owen

On 4/15/06, ph rhole oper <[EMAIL PROTECTED]> wrote:
I have a cyrus-imapd authenticating users through a krb5 kdc.Now i needwebmail interfacing too!Where do i start from?Is there websso (pubcookie,cosign) support insquirrelmail?Take a look at using Cyrus SASL.  Look here:
http://nakedape.cc/info/Cyrus-IMAP-HOWTO/quickstart.html#id2950694HTH,Nick-- Nick OwenWiKID Systems, Inc.
404.962.8983 (desk)404.542.9453 (cell)http://www.wikidsystems.comNow open source: http://sourceforge.net/projects/wikid-twofactor/

[SM-USERS] ERROR: Unknown IMAP response.

2006-06-11 Thread Nick Wilkens

I am recieving an error message after 2-3 days of uptime when using squirrelmail (horde works fine).I either get: "ERROR: Unknown IMAP response." or "ERROR: Connection dropped by IMAP server.", this happens for all users of the server.  The server load is minimal.

I saw a post on http://mailman1.u.washington.edu/pipermail/imap-use/2005-December/56.htmlwith the same symptoms, and the answer was to fix squirrel mail [ 
http://mailman1.u.washington.edu/pipermail/imap-use/2005-December/60.html ], or slow the imap server down. The problem goes away when I `strace` the imapd process, which in effect slows down the imap server.

Anyone know the proper way to fix this issue?
Details:
 

IMAP Server:courier-imap
PHP: PHP 4.4.2 (cli) (built: Apr 25 2006 16:27:06)Copyright (c) 1997-2006 The PHP GroupZend Engine v1.3.0, Copyright (c) 1998-2004 Zend Technologies
Web server: Server version: Apache/1.3.34 (Unix)Server built:   Apr 25 2006 16:15:39
Platform: RHEL3 2.4.21-40.ELsmp
How your software was installed: CPanel/WHM
SquirrelMail version : 1.4.6
Any notes that might make your install different, even if minor (like you have rewrite rules): mod_rewrite, mod_bwlimited, mod_log_bytes, mod_security.
Error Message: 
 
ERROR: Unknown IMAP response.Query: FETCH 1:* (FLAGS UID RFC822.SIZE INTERNALDATE BODY.PEEK[HEADER.FIELDS (Date To Cc From Subject X-Priority Importance Priority Content-Type)])Server responded: 
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] ERROR: Unknown IMAP response.

2006-06-21 Thread Nick Wilkens

Thanks for the information.  
 
I will be testing with a standard install.
 
We are not using an IMAP proxy.
 
Server side sorting and threading options were set to false in the config.php file, I have set server side sorting ($allow_server_sort = true;) should I also set $allow_thread_sort = true;? 
 
Thanks,
 Nick 
On 6/12/06, Tomas Kuliavas <[EMAIL PROTECTED]> wrote:
> I am recieving an error message after 2-3 days of uptime when using> squirrelmail (horde works fine).
> I either get: "ERROR: Unknown IMAP response." or "ERROR: Connection> dropped> by IMAP server.", this happens for all users of the server.  The server> load> is minimal.
>> I saw a post on> http://mailman1.u.washington.edu/pipermail/imap-use/2005-December/56.html> with the same symptoms, and the answer was to fix squirrel mail [
> http://mailman1.u.washington.edu/pipermail/imap-use/2005-December/60.html],> or slow the imap server down. The problem goes away when I `strace`
> the imapd process, which in effect slows down the imap server.>> Anyone know the proper way to fix this issue?Make sure that you can reproduce same issue in standard SquirrelMailinstallation without any enabled plugins.
Make sure that issue can be reproduced without IMAP proxy, if you use one.Provide information about SquirrelMail server side sorting and threadingoptions. If server side sorting is turned off in SquirrelMail 4. General
Options - make sure that you can reproduce issue, when sorting is turnedon.--Tomas--squirrelmail-users mailing listPosting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelinesList Address: squirrelmail-users@lists.sourceforge.netList Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.userList Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

[SM-USERS] apache pid segmentfault

2006-07-11 Thread Nick Smith

I have a strange problem and Ive gone through the entire "solving
problems" section of the SM website and googled for hours and cant
seem to find a resolution to the problem. I hope someone can shed some
light on this for me.

This is probably a system issue, but just incase it wasnt I want to
post the problem here and see what everyone thought.

I have an SLES 9 install with apache2/php4.3.4/SM 1.4.7/cyrus, at
first I was missing the php4-sessions and libmm modules so I got those
installed successfully but now when i try to get to the login page it
gives no error and its just a blank page, and in the apache error log
i just get an error that the apache pid that was processing the
request died:

[Tue Jul 11 16:02:30 2006] [notice] child pid 22754 exit signal
Segmentation fault (11)
[Tue Jul 11 16:02:30 2006] [notice] child pid 22863 exit signal
Segmentation fault (11)

I have no other error to go on that that, apache doesnt die, and other
php pages load just fine, but for some reason every time i try to load
the SM page it kills the pid that was trying to process the request.

What do you think? Is this some how just a borked system or is there
something im missing in the SM setup/install that would be causing
this? Can you point me in the right direction at least?

Thanks for all your help.

Nick


-
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] apache pid segmentfault

2006-07-11 Thread Nick Smith

>
> could you check SquirrelMail src/configtest.php script?
>
> --
> Tomas

That returns the same segment fault as the main login page.  Does this
indicate a corrupt install? I downloaded the latest off the SM website
and unzipped to the root of the webserver and set it up via the
./configure command and set it up for cyrus and the correct domain
etc.  What do you suggest?

thanks for the help.


-
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] apache pid segmentfault

On 7/12/06, Tomas Kuliavas <[EMAIL PROTECTED]> wrote:
> >>
> >> could you check SquirrelMail src/configtest.php script?
> >>
> >> --
> >> Tomas
> >
> > That returns the same segment fault as the main login page.  Does this
> > indicate a corrupt install? I downloaded the latest off the SM website
> > and unzipped to the root of the webserver and set it up via the
> > ./configure command and set it up for cyrus and the correct domain
> > etc.  What do you suggest?
>
> put die() calls in src/configtest.php and find line that causes apache
> segfault.
>
> or create test script with
>  session_start();
> echo session_id();
> ?>
>
> and see if it causes segfault.
>
> make sure that session.save_path setting has valid path
>

Yes the above also causes it to segfault.  The save_path is set to
/tmp and it is a valid path. and this is the output from my php -i |
grep session:

session
session.auto_start => Off => Off
session.bug_compat_42 => On => On
session.bug_compat_warn => On => On
session.cache_expire => 180 => 180
session.cache_limiter => nocache => nocache
session.cookie_domain => no value => no value
session.cookie_lifetime => 0 => 0
session.cookie_path => / => /
session.cookie_secure => Off => Off
session.entropy_file => no value => no value
session.entropy_length => 0 => 0
session.gc_divisor => 100 => 100
session.gc_maxlifetime => 1440 => 1440
session.gc_probability => 1 => 1
session.name => PHPSESSID => PHPSESSID
session.referer_check => no value => no value
session.save_handler => files => files
session.save_path => /tmp => /tmp
session.serialize_handler => php => php
session.use_cookies => On => On
session.use_only_cookies => Off => Off
session.use_trans_sid => Off => Off

Anything look messed up in there? also where do you set these settings? php.ini?


-
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] apache pid segmentfault

>
> Normal settings.
>
> See http://bugs.php.net/bug.php?id=22425
> [23 Aug 2005 4:51pm UTC] ben_as_usual at yahoo dot com
>
>
hmmm. thanks for the link, I did what it suggested and changed the
order in which the extensions load, but there were only two in the
list:

extension=mysql.so
extension=session.so

session.so was first, but and i moved it below mysql.so and restarted
apache and it still segfaults.

What else can i try?

thanks for you help.

Nick


-
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] apache pid segmentfault

On 7/12/06, Tomas Kuliavas <[EMAIL PROTECTED]> wrote:
> >>
> >> Normal settings.
> >>
> >> See http://bugs.php.net/bug.php?id=22425
> >> [23 Aug 2005 4:51pm UTC] ben_as_usual at yahoo dot com
> >>
> >>
> > hmmm. thanks for the link, I did what it suggested and changed the
> > order in which the extensions load, but there were only two in the
> > list:
> >
> > extension=mysql.so
> > extension=session.so
> >
> > session.so was first, but and i moved it below mysql.so and restarted
> > apache and it still segfaults.
> >
> > What else can i try?
>
> have you restarted apache after you modified php.ini?
>
>
How do i show the version numbers? and yes i did restart apache after
i modified the php.ini file.

php --version gives me this:

PHP 4.3.4 (cli) (built: Apr 19 2006 20:29:47)
Copyright (c) 1997-2003 The PHP Group
Zend Engine v1.3.0, Copyright (c) 1998-2003 Zend Technologies

What else do you need me to show and how do i go about doing it?

Thanks


-
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] apache pid segmentfault

>
> rpm -q -a | grep php
>
ok thanks

php4-mysql-4.3.4-43.53
apache2-mod_php4-4.3.4-43.53
php4-session-4.3.4-43.8
php4-4.3.4-43.53


-
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] apache pid segmentfault

On 7/12/06, Tomas Kuliavas <[EMAIL PROTECTED]> wrote:
> >>
> >> rpm -q -a | grep php
> >>
> > ok thanks
> >
> > php4-mysql-4.3.4-43.53
> > apache2-mod_php4-4.3.4-43.53
> > php4-session-4.3.4-43.8
> > php4-4.3.4-43.53
>
> you have php4 43.53 version and php4-session 43.8 version.
>
> Run Yast and make sure that you have installed all updates or make sure
> that php4 and php4-session package versions match.
>
>
YOU ARE THE MAN!

I did an online update and there was a security update for php which
brought all my versions up to:

php4-session-4.3.4-43.61
php4-4.3.4-43.61
apache2-mod_php4-4.3.4-43.61
php4-mysql-4.3.4-43.61

And i am now able to get to the login screen!

Thanks so much for your help, hopefully this will help someone else in
the future. And hopefully i dont have any more problems with this.

Thanks again

Nick.


-
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Spam Sent From WebMail

, not just that it went away when running a virus/trojan/backdoor
cleaner.

Sincerely,
Fredrik



I'm not sure if he found a way to combat the problem, but I have had the 
same issue twice now. In both cases it wasn't a virus/trojan on the 
users' machine that was doing the sending, but actually a botnet using 
compromised authorization information. In the first bout of this, it was 
weak passwords. We corrected all weak passwords on the system, that was 
about three months ago.


This time, a users' PC appears to have been infected with a trojan of 
some sort which was able to pull their username & password out of 
something (suspect IE saved forms), then the botnet used that to relay 
mail out of squirrelmail. I've since followed the instructions on the 
wiki to turn off autocomplete on the login form.


Obviously, this isn't a bug in squirrelmail, but given the environment 
on the internet right now, perhaps one fix might be for the SM team to 
re-code whatever is allowing these POST url's to send mail. Turning off 
autocomplete might also be a sane default.


Regardless of that, here's a few details on my system:

CentOS 4.5 w/ squirrelmail-1.4.8-4.0.1.el4.centos. Plugins are:

  Installed Plugins
1. delete_move_next
2. squirrelspell
3. newmail
4. mpppolicygroup
5. quota_usage

Apache version httpd-2.0.52-32.3.ent.centos4 w/ mod_access_rbl
PHP version php-4.3.9-3.22.9

Some more thoughts:

Per some suggestions in the thread I was able to determine that they are
not using "mailto.php", but rather compose.php:

/var/log/httpd/access_log:196.1.179.183 - - [07/Oct/2007:21:54:10 -0500]
"GET /webmail/src/compose.php?mail_sent=yes HTTP/1.1" 200 37102
"http://webmail.terraworld.net/webmail/src/compose.php?mailbox=None&startMessage=0";
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

Nobody can reasonably expect an ISP to keep every single users' PC clean
of trashware constantly, so accordingly there needs to be some way to
mitigate the impact of this type of issue at the common point - the 
SquirrelMail installation. It doesn't seem to me like this is a bug or a 
security vulnerability in SM since a valid users' password was 
compromised, but is there any way to mitigate this type of thing?


I would appreciate any feedback regarding this topic and methods of
mitigating damage done by compromised accounts. I will also answer any
questions that may help develop a method of mitigation.

- Nick Bright
  Terra World
  http://home.terraworld.net



begin:vcard
fn:Nick Bright
n:Bright;Nick
org:Terra World Communications, LLC
adr:Suite #11;;200 ARCO Place;Independence;KS;67301;USA
email;internet:[EMAIL PROTECTED]
title:Network Administrator
tel;work:888-332-1616
tel;fax:620-332-1201
x-mozilla-html:FALSE
url:http://home.terraworld.net
version:2.1
end:vcard

-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Spam Sent From WebMail


Ken A wrote:

Nick Bright wrote:


Per some suggestions in the thread I was able to determine that they are
not using "mailto.php", but rather compose.php:

/var/log/httpd/access_log:196.1.179.183 - - [07/Oct/2007:21:54:10 -0500]
"GET /webmail/src/compose.php?mail_sent=yes HTTP/1.1" 200 37102
"http://webmail.terraworld.net/webmail/src/compose.php?mailbox=None&startMessage=0"; 


"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"



Are you saying that was the only entry in the log from that IP? They 
only hit compose.php? If not, what was the sequence of events?


There were many hits from quite a few different IP addresses, and they 
all looked simmilar to that. I've extracted log entries from that IP 
address, and attached the file to this message.


From what I can tell it logs in, then hits compose.php repeatedly.

 - Nick



Ken



Nobody can reasonably expect an ISP to keep every single users' PC clean
of trashware constantly, so accordingly there needs to be some way to
mitigate the impact of this type of issue at the common point - the 
SquirrelMail installation. It doesn't seem to me like this is a bug or a 
security vulnerability in SM since a valid users' password was 
compromised, but is there any way to mitigate this type of thing?


I would appreciate any feedback regarding this topic and methods of
mitigating damage done by compromised accounts. I will also answer any
questions that may help develop a method of mitigation.

- Nick Bright
  Terra World
  http://home.terraworld.net


196.1.179.183 - - [08/Oct/2007:12:05:31 -0500] "GET /webmail/src/webmail.php 
HTTP/1.1" 200 1215 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
196.1.179.183 - - [08/Oct/2007:12:05:33 -0500] "GET /webmail/images/sm_logo.png 
HTTP/1.1" 200 7396 "http://webmail.terraworld.net/webmail/src/webmail.php"; 
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
196.1.179.183 - - [08/Oct/2007:12:06:11 -0500] "GET /webmail/src/login.php 
HTTP/1.1" 200 12634 "http://webmail.terraworld.net/webmail/src/webmail.php"; 
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
196.1.179.183 - - [08/Oct/2007:12:07:01 -0500] "POST /webmail/src/redirect.php 
HTTP/1.1" 200 1201 "http://webmail.terraworld.net/webmail/src/login.php"; 
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
196.1.179.183 - - [07/Oct/2007:21:26:26 -0500] "GET /webmail/src/webmail.php 
HTTP/1.1" 200 1215 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
196.1.179.183 - - [07/Oct/2007:21:26:28 -0500] "GET /webmail/images/sm_logo.png 
HTTP/1.1" 200 7396 "http://webmail.terraworld.net/webmail/src/webmail.php"; 
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
196.1.179.183 - - [07/Oct/2007:21:29:22 -0500] "GET /webmail/src/login.php 
HTTP/1.1" 200 12615 "http://webmail.terraworld.net/webmail/src/webmail.php"; 
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
196.1.179.183 - - [07/Oct/2007:21:30:15 -0500] "POST /webmail/src/redirect.php 
HTTP/1.1" 302 - "http://webmail.terraworld.net/webmail/src/login.php"; 
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
196.1.179.183 - - [07/Oct/2007:21:30:18 -0500] "GET 
/webmail/src/webmail.php?right_frame=/webmail/src/webmail.php HTTP/1.1" 200 351 
"http://webmail.terraworld.net/webmail/src/login.php"; "Mozilla/4.0 (compatible; 
MSIE 6.0; Windows NT 5.1; SV1)"
196.1.179.183 - - [07/Oct/2007:21:30:21 -0500] "GET 
/webmail/src/%2Fwebmail%2Fsrc%2Fwebmail.php HTTP/1.1" 404 322 
"http://webmail.terraworld.net/webmail/src/webmail.php?right_frame=/webmail/src/webmail.php";
 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
196.1.179.183 - - [07/Oct/2007:21:30:21 -0500] "GET /webmail/src/left_main.php 
HTTP/1.1" 200 2876 
"http://webmail.terraworld.net/webmail/src/webmail.php?right_frame=/webmail/src/webmail.php";
 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
196.1.179.183 - - [07/Oct/2007:21:31:35 -0500] "GET 
/webmail/src/right_main.php?PG_SHOWALL=0&sort=0&startMessage=1&mailbox=INBOX 
HTTP/1.1" 200 5253 "http://webmail.terraworld.net/webmail/src/left_main.php"; 
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
196.1.179.183 - - [07/Oct/2007:21:31:38 -0500] "GET 
/webmail/images/down_pointer.png HTTP/1.1" 200 272 
"http://webmail.terraworld.net/webmail/src/right_main.php?PG_SHOWALL=0&sort=0&startMessage=1&mailbox=INBOX";
 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
196.1.179.183 - - [07/Oct/2007:21:31:39 -0500] "GET 
/webmail/images/sort_

Re: [SM-USERS] Spam Sent from WebMail

2007-10-09 Thread nick-tech

Sorry to reopen a thread, but I am seeing the same issue as the original
poster in this thread:

http://sourceforge.net/mailarchive/message.php?msg_id=c11d02530709050557ldb78519i4cdecd1ea08dc368%40mail.gmail.com

In that I am seeing spam sent through my SM install, packages are:

CentOS 4.5 w/ squirrelmail-1.4.8-4.0.1.el4.centos. Plugins are:

Installed Plugins
1. delete_move_next
2. squirrelspell
3. newmail
4. mpppolicygroup
5. quota_usage

Available Plugins:
6. translate
7. compatibility
8. spamcop
9. sent_subfolders
10. check_quota
11. filters
12. calendar
13. info
14. message_details
15. listcommands
16. mail_fetch
17. twc_weather
18. show_thumb
19. captcha
20. bug_report
21. fortune
22. lockout
23. administrator
24. addgraphics
25. abook_take

Apache version httpd-2.0.52-32.3.ent.centos4 w/ mod_access_rbl
PHP version php-4.3.9-3.22.9

Symtoms are:

Somehow a botnet operator gets ahold of a valid username and password. I
assume through trojan activity. The botnet then proceeds to sent mail
through squirrelmail using a *valid* username and password. I think that
it is a botnet because the same username has many hits from widely varying
IP addresses. Changing the password blocks the spam and stops the
behavior.

I am certain that this is not a case of forged headers for the same
reasons as the OP: Spam shows up in the Sent folder, disabling the account
stops the spam, and I see the traffic in the web server logs. We have also
been blacklisted on a couple of RBL's due to this issue.

Per some suggetions in the thread I was able to determine that they are
not using "mailto.php", but rather compose.php:

/var/log/httpd/access_log:196.1.179.183 - - [07/Oct/2007:21:54:10 -0500]
"GET /webmail/src/compose.php?mail_sent=yes HTTP/1.1" 200 37102
"http://webmail.terraworld.net/webmail/src/compose.php?mailbox=None&startMessage=0";
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

It doesn't seem to me like this is a bug or a security vulnerability in SM
since a valid users' password was compromised, but is there any way to
mitigate this type of thing?

Nobody can reasonably expect an ISP to keep every single users' PC clean
of trashware constantly, so accordingly there needs to be some way to
mitigate the impact of this type of issue.

This happened once before, but it was an assault against weak passwords in
our accounting systems. We cleaned that problem up and as a result
installed mod_access_rbl on the web server, which does RBL checks against
spamcop - anyone that tries to log in to webmail has to make it past that
RBL check, but still this has happened! The total number of spams in the
users "Sent" box was only a few hundred, so it seems like the RBL mod
helped quite a bit, but still some IP addresses on the botnet were not
RBL'd.

I would appreciate any feedback regarding this topic and methods of
mitigating damage done by compromised accounts. I will also answer any
questions that may help develop a method of mitigation.

If anyone is interested in the mod_access_rbl, I'm having trouble finding
the original page, but I do have a patch file I can send you.

- Nick Bright
Network Admin
Terra World

-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
--
squirrelmail-users mailing list
Posting Guidelines:
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives:
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives: http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Spam Sent From WebMail


Ken A wrote:

Nick Bright wrote:

Ken A wrote:

Nick Bright wrote:


Per some suggestions in the thread I was able to determine that they are
not using "mailto.php", but rather compose.php:

/var/log/httpd/access_log:196.1.179.183 - - [07/Oct/2007:21:54:10 -0500]
"GET /webmail/src/compose.php?mail_sent=yes HTTP/1.1" 200 37102
"http://webmail.terraworld.net/webmail/src/compose.php?mailbox=None&startMessage=0"; 


"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"


Are you saying that was the only entry in the log from that IP? They 
only hit compose.php? If not, what was the sequence of events?
There were many hits from quite a few different IP addresses, and they 
all looked simmilar to that. I've extracted log entries from that IP 
address, and attached the file to this message.


 From what I can tell it logs in, then hits compose.php repeatedly.


That's odd. It really doesn't look like a bot. Perhaps it's using an IE 
toolbar of some sort to control the browser. There is a CAPTCHA plugin, 
and a "Password Forget" plugin, but when a bot behaves like a user, it's 
hard to block without inconveniencing the user. :-\


Yes that was my take as well, it really looks like a user using
webmail but when I go through my AOL mail loop messages they show
headers such as:

from 81.199.179.36 (proxying for 10.250.50.255)(SquirrelMail
authenticated user exploiteduser)by webmail.terraworld.net with
HTTP;Thu, 4 Oct 2007 18:57:06 -0500 (CDT)

IP Addresses from AOL mail loop:
196.1.179.183
78.138.2.196
41.219.220.2
81.199.179.36
84.254.188.2
88.202.124.6

Where the IP address connecting as user "exploiteduser" varies widely,
and the attached message is always the same 'lottry' phishing scam. I 
suppose it's possible that it's coming from the users' PC (they are on 
dialup after all), but the IP addresses vary so widely that I seriously 
doubt that it's one PC. The list is relatively short because I would 
expect most of the botnet to be listed on RBL's, and my web server 
blocks based on RBL lookups.


 - Nick



Ken



 - Nick


Ken



Nobody can reasonably expect an ISP to keep every single users' PC clean
of trashware constantly, so accordingly there needs to be some way to
mitigate the impact of this type of issue at the common point - the 
SquirrelMail installation. It doesn't seem to me like this is a bug 
or a security vulnerability in SM since a valid users' password was 
compromised, but is there any way to mitigate this type of thing?


I would appreciate any feedback regarding this topic and methods of
mitigating damage done by compromised accounts. I will also answer any
questions that may help develop a method of mitigation.

- Nick Bright
  Terra World
  http://home.terraworld.net



-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/




--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users





begin:vcard
fn:Nick Bright
n:Bright;Nick
org:Terra World Communications, LLC
adr:Suite #11;;200 ARCO Place;Independence;KS;67301;USA
email;internet:[EMAIL PROTECTED]
title:Network Administrator
tel;work:888-332-1616
tel;fax:620-332-1201
x-mozilla-html:FALSE
url:http://home.terraworld.net
version:2.1
end:vcard

-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Spam Sent from WebMail


Tomas Kuliavas wrote:

CentOS 4.5 w/ squirrelmail-1.4.8-4.0.1.el4.centos. Plugins are:


CVE-2006-6142, CVE-2007-1262, CVE-2007-2589. Please note that html
filtering functions must be patched to 1.4.10+ level. Having only 1.4.9a
patches is not enough. If changelog says that CVE-2006-6142 is fixed,
check functions/mime.php and make sure that it is similar to 1.4.10a file
and not to 1.4.9a file.


Doesn't seem like it's a security vulnerability in squirrelmail causing 
this, though your point is valid with regard to the CVE's.





  Installed Plugins
1. delete_move_next
2. squirrelspell
3. newmail
4. mpppolicygroup
5. quota_usage

  Available Plugins:
6. translate
7. compatibility
8. spamcop
9. sent_subfolders
10. check_quota


Version of check_quota plugin? PHP register_globals setting?


check_quota version 1.4
register_globals = off




Per some suggetions in the thread I was able to determine that they are
not using "mailto.php", but rather compose.php:

/var/log/httpd/access_log:196.1.179.183 - - [07/Oct/2007:21:54:10 -0500]
"GET /webmail/src/compose.php?mail_sent=yes HTTP/1.1" 200 37102
"http://webmail.terraworld.net/webmail/src/compose.php?mailbox=None&startMessage=0";
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"


Wrong log entry. What you have in logs before this redirection is made in
SquirrelMail. This page only displays notice that message is send.


In another post, I attached the results of a grep for a specific IP.



If you know ip of spammer, check all log entries from that ip address. You
must trace whole path. How do they log in? Is there a legit login for same
account at that time? Which pages are opened?


They appear to emulate a browser, from what I can tell. They are using a 
valid username and password apparently culled from an infected PC somewhere.




Have you tried to protect your webmail traffic? Signed SSL certificate
costs less than 20 USD.


I'd expect they support SSL on their end, this probably wouldn't make 
any difference.


 - Nick Bright




begin:vcard
fn:Nick Bright
n:Bright;Nick
org:Terra World Communications, LLC
adr:Suite #11;;200 ARCO Place;Independence;KS;67301;USA
email;internet:[EMAIL PROTECTED]
title:Network Administrator
tel;work:888-332-1616
tel;fax:620-332-1201
x-mozilla-html:FALSE
url:http://home.terraworld.net
version:2.1
end:vcard

-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Spam Sent From WebMail


Paul Lesniewski wrote:

On 10/9/07, Ken A <[EMAIL PROTECTED]> wrote:

Nick Bright wrote:

Ken A wrote:

Nick Bright wrote:


Per some suggestions in the thread I was able to determine that they are
not using "mailto.php", but rather compose.php:

/var/log/httpd/access_log:196.1.179.183 - - [07/Oct/2007:21:54:10 -0500]
"GET /webmail/src/compose.php?mail_sent=yes HTTP/1.1" 200 37102
"http://webmail.terraworld.net/webmail/src/compose.php?mailbox=None&startMessage=0";

"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"


Are you saying that was the only entry in the log from that IP? They
only hit compose.php? If not, what was the sequence of events?

There were many hits from quite a few different IP addresses, and they
all looked simmilar to that. I've extracted log entries from that IP
address, and attached the file to this message.

 From what I can tell it logs in, then hits compose.php repeatedly.

That's odd. It really doesn't look like a bot.


I agree - a bot probably wouldn't hit any options pages, etc.


Someone else said that they saw the same behavior, and the bot was 
hitting the options page to change the FROM address and users' name.





Perhaps it's using an IE
toolbar of some sort to control the browser. There is a CAPTCHA plugin,
and a "Password Forget" plugin, but when a bot behaves like a user, it's
hard to block without inconveniencing the user. :-\


Right.  I would suggest the Restrict Senders plugin is what the OP
wants if "mitigation" is the goal.  "Re-coding whatever is allowing
these POST url's to send mail" is meaningless unless you want SM
without compose functionality.


I'll look at the restrict senders plugin.

My suggestion about not allowing POST to send mail is based on me not 
knowing anything about how SM works, but the thought of "if they can't 
craft a URL to send mail and poke it to the server, wouldn't that fix 
the issue?". Seems like GET should be just as valid, and prevent an 
injection exploit like this appears to be.


Please keep in mind I am not a programmer, just a user, so there's not 
much good in raking me over the coals with programming arguments.


 - Nick Bright



-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users
begin:vcard
fn:Nick Bright
n:Bright;Nick
org:Terra World Communications, LLC
adr:Suite #11;;200 ARCO Place;Independence;KS;67301;USA
email;internet:[EMAIL PROTECTED]
title:Network Administrator
tel;work:888-332-1616
tel;fax:620-332-1201
x-mozilla-html:FALSE
url:http://home.terraworld.net
version:2.1
end:vcard

-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Spam Sent from WebMail


Paul Lesniewski wrote:

On 10/9/07, Tomas Kuliavas <[EMAIL PROTECTED]> wrote:

CentOS 4.5 w/ squirrelmail-1.4.8-4.0.1.el4.centos. Plugins are:

CVE-2006-6142, CVE-2007-1262, CVE-2007-2589. Please note that html
filtering functions must be patched to 1.4.10+ level. Having only 1.4.9a
patches is not enough. If changelog says that CVE-2006-6142 is fixed,
check functions/mime.php and make sure that it is similar to 1.4.10a file
and not to 1.4.9a file.


Yeah, the first thing you do when you have a problem like this is
ensure all your software is up to date.  I am shocked the OP lets that
slip by.


Perhaps because it was two in the morning I didn't notice that 1.4.9a 
was quite so old :/ It seems odd to me that the RHEL/CentOS team 
wouldn't have a more up to date version. I'm sure that the CVE's are 
patched though.





  Installed Plugins
1. delete_move_next
2. squirrelspell
3. newmail
4. mpppolicygroup
5. quota_usage

  Available Plugins:
6. translate
7. compatibility
8. spamcop
9. sent_subfolders
10. check_quota

Version of check_quota plugin? PHP register_globals setting?


Per some suggetions in the thread I was able to determine that they are
not using "mailto.php", but rather compose.php:

/var/log/httpd/access_log:196.1.179.183 - - [07/Oct/2007:21:54:10 -0500]
"GET /webmail/src/compose.php?mail_sent=yes HTTP/1.1" 200 37102
"http://webmail.terraworld.net/webmail/src/compose.php?mailbox=None&startMessage=0";
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

Wrong log entry. What you have in logs before this redirection is made in
SquirrelMail. This page only displays notice that message is send.

If you know ip of spammer, check all log entries from that ip address. You
must trace whole path. How do they log in? Is there a legit login for same
account at that time? Which pages are opened?


See the other, original thread about this.  The OP should not be
creating duplicate threads with identical information in them.


It's all the same thread if you ask me. There were no newer messages in 
the thread, and I just subscribed to the list, so I created a new 
message with a link to the old thread in the mailing list archive, and 
submitted my information.


However, after about 36 hours it still hadn't arrived on the list, and 
someone else replied to the original thread, so I just jumped in.





Have you tried to protect your webmail traffic? Signed SSL certificate
costs less than 20 USD.


-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users
begin:vcard
fn:Nick Bright
n:Bright;Nick
org:Terra World Communications, LLC
adr:Suite #11;;200 ARCO Place;Independence;KS;67301;USA
email;internet:[EMAIL PROTECTED]
title:Network Administrator
tel;work:888-332-1616
tel;fax:620-332-1201
x-mozilla-html:FALSE
url:http://home.terraworld.net
version:2.1
end:vcard

-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Spam Sent from WebMail


Ken A wrote:

Nick Bright wrote:

Tomas Kuliavas wrote:



Have you tried to protect your webmail traffic? Signed SSL certificate
costs less than 20 USD.
I'd expect they support SSL on their end, this probably wouldn't make 
any difference.


The difference is that fewer passwords could easily be stolen if you 
used & forced SSL. This is certainly relevant.

Ken


How so? that would only prevent man in the middle attacks, when the 
problem is almost certainly in a keylogger or trojan on the end users' 
PC - where the keyboard input isn't encrypted by the SSL certificate.


Though yes, I do want to use/force an SSL certificate, I do not agree 
that it would help with the issue at hand.





 - Nick Bright




begin:vcard
fn:Nick Bright
n:Bright;Nick
org:Terra World Communications, LLC
adr:Suite #11;;200 ARCO Place;Independence;KS;67301;USA
email;internet:[EMAIL PROTECTED]
title:Network Administrator
tel;work:888-332-1616
tel;fax:620-332-1201
x-mozilla-html:FALSE
url:http://home.terraworld.net
version:2.1
end:vcard

-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Spam Sent From WebMail


Paul Lesniewski wrote:

Please do NOT top-post and try to use correct reply quoting.

On 10/9/07, Brent <[EMAIL PROTECTED]> wrote:

I had this exact issue.  It ended up being one exploited account.  The IP
addresses connecting to the account were from various APNIC blocks.  I would
block one IP and it would move to another... suggesting that it was some
kind of bot - however, I added the captcha plugin and they kept logging in!
I changed the password on the exploited account and so far it hasn't
resurfaced.


You might have chosen a weak CAPTCHA mechanism.  It might be useful
for others if you mention which CAPTCHA backend you used (and if you
tried any others).


What mechanism do you suggest, I am looking at using this plugin, but 
there is quite the array of options for mechanisms to use.





Per some suggestions in the thread I was able to determine that they

are

not using "mailto.php", but rather compose.php:

/var/log/httpd/access_log:196.1.179.183 - - [07/Oct/2007:21:54:10

-0500]

"GET /webmail/src/compose.php?mail_sent=yes HTTP/1.1" 200 37102


"http://webmail.terraworld.net/webmail/src/compose.php?mailbox=None&startMes
sage=0"

"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

Are you saying that was the only entry in the log from that IP? They
only hit compose.php? If not, what was the sequence of events?

There were many hits from quite a few different IP addresses, and they
all looked simmilar to that. I've extracted log entries from that IP
address, and attached the file to this message.

 From what I can tell it logs in, then hits compose.php repeatedly.

That's odd. It really doesn't look like a bot. Perhaps it's using an IE
toolbar of some sort to control the browser. There is a CAPTCHA plugin,
and a "Password Forget" plugin, but when a bot behaves like a user, it's
hard to block without inconveniencing the user. :-\

Yes that was my take as well, it really looks like a user using
webmail but when I go through my AOL mail loop messages they show
headers such as:

from 81.199.179.36 (proxying for 10.250.50.255)(SquirrelMail
authenticated user exploiteduser)by webmail.terraworld.net with
HTTP;Thu, 4 Oct 2007 18:57:06 -0500 (CDT)

IP Addresses from AOL mail loop:
196.1.179.183
78.138.2.196
41.219.220.2
81.199.179.36
84.254.188.2
88.202.124.6

Where the IP address connecting as user "exploiteduser" varies widely,
and the attached message is always the same 'lottry' phishing scam. I
suppose it's possible that it's coming from the users' PC (they are on
dialup after all), but the IP addresses vary so widely that I seriously
doubt that it's one PC. The list is relatively short because I would
expect most of the botnet to be listed on RBL's, and my web server
blocks based on RBL lookups.

  - Nick


Ken



 - Nick


Ken



Nobody can reasonably expect an ISP to keep every single users' PC

clean

of trashware constantly, so accordingly there needs to be some way to
mitigate the impact of this type of issue at the common point - the
SquirrelMail installation. It doesn't seem to me like this is a bug
or a security vulnerability in SM since a valid users' password was
compromised, but is there any way to mitigate this type of thing?

I would appreciate any feedback regarding this topic and methods of
mitigating damage done by compromised accounts. I will also answer any
questions that may help develop a method of mitigation.

- Nick Bright


-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users
begin:vcard
fn:Nick Bright
n:Bright;Nick
org:Terra World Communications, LLC
adr:Suite #11;;200 ARCO Place;Independence;KS;67301;USA
email;internet:[EMAIL PROTECTED]
title:Network Administrator
tel;work:888-332-1616
tel;fax:620-332-1201
x-mozilla-html:FALSE
url:http://home.terraworld.net
version:2.1
end:vcard

-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/--
squirrelmail-users mailing l

Re: [SM-USERS] Spam Sent From WebMail


Paul Lesniewski wrote:

On 10/9/07, Nick Bright <[EMAIL PROTECTED]> wrote:

Paul Lesniewski wrote:

On 10/9/07, Ken A <[EMAIL PROTECTED]> wrote:

Nick Bright wrote:

Ken A wrote:

Nick Bright wrote:


Per some suggestions in the thread I was able to determine that they are
not using "mailto.php", but rather compose.php:

/var/log/httpd/access_log:196.1.179.183 - - [07/Oct/2007:21:54:10 -0500]
"GET /webmail/src/compose.php?mail_sent=yes HTTP/1.1" 200 37102
"http://webmail.terraworld.net/webmail/src/compose.php?mailbox=None&startMessage=0";

"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

Are you saying that was the only entry in the log from that IP? They
only hit compose.php? If not, what was the sequence of events?

There were many hits from quite a few different IP addresses, and they
all looked simmilar to that. I've extracted log entries from that IP
address, and attached the file to this message.

 From what I can tell it logs in, then hits compose.php repeatedly.

That's odd. It really doesn't look like a bot.

I agree - a bot probably wouldn't hit any options pages, etc.

Someone else said that they saw the same behavior, and the bot was
hitting the options page to change the FROM address and users' name.


Perhaps it's using an IE
toolbar of some sort to control the browser. There is a CAPTCHA plugin,
and a "Password Forget" plugin, but when a bot behaves like a user, it's
hard to block without inconveniencing the user. :-\

Right.  I would suggest the Restrict Senders plugin is what the OP
wants if "mitigation" is the goal.  "Re-coding whatever is allowing
these POST url's to send mail" is meaningless unless you want SM
without compose functionality.

I'll look at the restrict senders plugin.

My suggestion about not allowing POST to send mail is based on me not
knowing anything about how SM works, but the thought of "if they can't
craft a URL to send mail and poke it to the server, wouldn't that fix
the issue?". Seems like GET should be just as valid, and prevent an
injection exploit like this appears to be.


You yourself seemed to agree it *isn't* an injection exploit.  If you
are claiming it is, we need evidence to support that.  GET is *more*
vulnerable in general than POST to various forms of abuse, not to
mention that it just wouldn't work for a form with this much data in
it.  Your problem is exposed passwords, so I don't know why you are
suggesting SM's internal mechanism for sending mail be modified.


Then just ignore my comments about the internal mechanisms. As I clearly 
stated, I have no idea how the guts work, and I'm not a programmer anyways.


As far as exploits go yes, there is exploitation going on, but no it 
doesn't appear to be because of a bug or vulnerability in SM. It's going 
on because a user got their password swiped. That's a big difference 
between that and a buffer overrun that lets someone run wild with your 
system.


My attempted suggestion was merely "hey, could this particular method be 
broken by changing part X". Your answer is obviously "No, it can't", so 
lets just leave it at that.





Please keep in mind I am not a programmer, just a user, so there's not
much good in raking me over the coals with programming arguments.

  - Nick Bright



-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users
begin:vcard
fn:Nick Bright
n:Bright;Nick
org:Terra World Communications, LLC
adr:Suite #11;;200 ARCO Place;Independence;KS;67301;USA
email;internet:[EMAIL PROTECTED]
title:Network Administrator
tel;work:888-332-1616
tel;fax:620-332-1201
x-mozilla-html:FALSE
url:http://home.terraworld.net
version:2.1
end:vcard

-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lis

Re: [SM-USERS] Spam Sent from WebMail

2007-10-10 Thread Nick Bright

Tomas Kuliavas wrote:
   Installed Plugins
 1. delete_move_next
 2. squirrelspell
 3. newmail
 4. mpppolicygroup
 5. quota_usage

   Available Plugins:
 6. translate
 7. compatibility
 8. spamcop
 9. sent_subfolders
 10. check_quota
>>> Version of check_quota plugin? PHP register_globals setting?
>> check_quota version 1.4
>> register_globals = off
> 
> OK. We can exclude check_quota.
> 
 Per some suggetions in the thread I was able to determine that they are
 not using "mailto.php", but rather compose.php:

 /var/log/httpd/access_log:196.1.179.183 - - [07/Oct/2007:21:54:10
 -0500]
 "GET /webmail/src/compose.php?mail_sent=yes HTTP/1.1" 200 37102
 "http://webmail.terraworld.net/webmail/src/compose.php?mailbox=None&startMessage=0";
 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
>>> Wrong log entry. What you have in logs before this redirection is made
>>> in
>>> SquirrelMail. This page only displays notice that message is send.
>> In another post, I attached the results of a grep for a specific IP.
>>
>>> If you know ip of spammer, check all log entries from that ip address.
>>> You
>>> must trace whole path. How do they log in? Is there a legit login for
>>> same
>>> account at that time? Which pages are opened?
>> They appear to emulate a browser, from what I can tell. They are using a
>> valid username and password apparently culled from an infected PC
>> somewhere.
> 
> Which pages? Are they using GET or POST requests? Show whole request
> sequence used to send emails. Attacker can change IP address, but
> abuse/attack/exploit methods should be the same.
> 
> 1. GET or POST request of redirect.php
> 2. Do you have more than one src/compose.php request before compose.php
> request with mail_sent=yes?

I already sent a message to the list with a log attached, on 10/9 around 
11:23am CST. To avoid reposting the same information, could you look at 
that message, or reply to me off list and I can send you the file.

To summarize:

GET webmail.php
GET sm_logo.php
GET login.php
POST redirect.php
GET webmail.php
GET %2Fwebmail%2Fsrc%2Fwebmail.php (I thought this one was odd)
GET left_main.php
GET right_main.php
GET options.php
GET options.php?optpage=personal
GET options_identities.php
POST options_identities.php
GET options.php
POST options.php
GET compose.php?mailbox=None&startMessage=0

POST compose.php 
"http://webmail.terraworld.net/webmail/src/compose.php?mailbox=None&startMessage=0";

GET compose.php?mail_sent=yes


> 
> Are they sharing same session information? You might have to increase
> logging in SquirrelMail in order to detect it. Without increased logging
> you can suspect it, if different IP addresses are using src/compose.php
> without hitting src/redirect.php first.
> 
>>> Have you tried to protect your webmail traffic? Signed SSL certificate
>>> costs less than 20 USD.
>> I'd expect they support SSL on their end, this probably wouldn't make
>> any difference.
> 
> It blocks password sniffers that are not on user's machine. User sends
> password only once per login, but other requests have enough information
> to hijack user's session in standard PHP session setups.
> 

-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
--
squirrelmail-users mailing list
Posting Guidelines: 
http://www.squirrelmail.org/wiki/MailingListPostingGuidelines
List Address: squirrelmail-users@lists.sourceforge.net
List Archives: 
http://news.gmane.org/thread.php?group=gmane.mail.squirrelmail.user
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

[SM-USERS] Blocking based on From and To fields

2008-01-27 Thread NICK MISEUR

Hi,

can anyone advice me which plugin is the best suitable and easy to achieve the
following:

1. block from within end user interface e-mails based on "from" field
2. block from within end user interface e-mails based on "to" field

Don't need anti software to decidede what is spam or not, I just need the
ability to block/black list e-mail addresses quickly

Thanks
Nick



-
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse012070mrt/direct/01/
-
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@lists.sourceforge.net
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): 
https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] One time password for SM

2008-05-20 Thread Nick Owen

>> I don't think so, but as I said, I could be wrong.
>
> I think you are.  WHY don't you think so?  If imapproxy decides it's
> time to release the user's login session (sure, this depends on a
> number of factors in the configuration of all the tools involved -
> imapproxy, SM, PHP), the password is lost and your webmail session
> dies unexpectedly.  If you have enough idle time configured into
> everything and auto folder list refresh turned on, you might be able
> to get away with it, but this relies on a user config setting (folder
> refresh), which isn't ideal.

ahh, you are correct - I mis-read your post (sorry - too many windows
open literally and figuratively).  Imapproxy will time out a session
forcing you to generate a new OTP.  However, I view that as a security
feature and not as a problem. If you need two-factor authentication
for webmail you also want to time-out the sessions - and so it should
not be "unexpected".

>
>> N.B: the version in the how-to uses radius, which is not part of the
>> open source Community Version.  However, we have a PHP network client
>> that could be integrated with the Community version.  Also, since I
>> wrote that how-to for SM, we have added mutual https authentication
>> that prevents network-based MITM attacks by validating the ssl cert
>> for the user. You can find out more about that
>> here:http://www.wikidsystems.com/learn-more/technology/mutual_authentication.
>
> Keep up the great work!

Thanks!

>
>
>>>>> OR are there other suggestions?  TIA
>>>>
>>>> A plugin hooked into the logout page of SquirrelMail could be used to
>>>> create a new password if the system allows it, but I don't have any
>>>> suggestions right now on how to do that in practise.
>>>
>>> I actually have a plugin sitting around that creates OTPs from within
>>> the SM interface (they are ONLY *SquirrelMail* OTPs); the somewhat
>>> insecure part of the puzzle being that SM actually takes the user's
>>> real password and stores it in an encrypted file.  The encryption is
>>> decent (any mcrypt-supported algorithm works), but it's still always
>>> an iffy proposition for an application to store user passwords.  This
>>> particular plugin is years old and needs a lot of face-lifting before
>>> it would be ready for use.
>
> -
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse012070mrt/direct/01/
> -
> squirrelmail-users mailing list
> Posting guidelines: http://squirrelmail.org/postingguidelines
> List address: squirrelmail-users@lists.sourceforge.net
> List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
> List info (subscribe/unsubscribe/change options): 
> https://lists.sourceforge.net/lists/listinfo/squirrelmail-users
>



-- 
-- 
Nick Owen
WiKID Systems, Inc.
404.962.8983
http://www.wikidsystems.com
Commercial/Open Source Two-Factor Authentication

-
This SF.net email is sponsored by: Microsoft 
Defy all challenges. Microsoft(R) Visual Studio 2008. 
http://clk.atdmt.com/MRT/go/vse012070mrt/direct/01/
-
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@lists.sourceforge.net
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): 
https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] One time password for SM

2008-05-20 Thread Nick Owen

On Tue, May 20, 2008 at 12:34 PM, Paul Lesniewski <[EMAIL PROTECTED]> wrote:
> On Tue, May 20, 2008 at 8:39 AM, Fredrik Jervfors
> <[EMAIL PROTECTED]> wrote:
>>> Ubuntu 7.04 server amd64
>>> SM 1.4.11
>>>
>>> I'm prepared adding One-Time-Password to SM as experiment.  Please
>>> advise are following packages working on SM;
>>>
>>> opie-client opie-server libopie-dev
>>>
>>> They are on Ubuntu repo.
>>
>> No. Since SquirrelMail logs in to the IMAP server at least once per page
>> view, OPT is worthless. You might not even get as far as to loading both
>> frames after logging in, since the password will change every time you use
>> it. Using an IMAP proxy might help though, until it times out and the
>> connection to the IMAP server is lost. Every time the connection is closed
>> or lost, a new password will be generated and throw you back to the
>> SquirrelMail login page.

You can get around this using Imapproxy - as noted in the doc.  It's
been awhile since I wrote this, so I could be out-of-date.

>>
>>> On googling I found;
>>> Open Source Two-factor authentication: The WiKID Community Edition
>>> http://www.wikidsystems.com/community-version
>>>
>>> Can it work on SM?  If YES which package/packages shall I download?

The packages are listed in the how-to and in the original doc I used
to install everything:
http://nakedape.cc/info/Cyrus-IMAP-HOWTO/quickstart-fedora.html

>>
>> They state that they can. A link marked "Squirrelmail and other IMAP
>> services" on the first page links to
>> <http://www.wikidsystems.com/community-version/documentation/howtos/two_factor_webmail>.
>
> Their instructions depend on the weakness Fredrik pointed out not
> happening: the IMAP proxy server timing out your credentials.

I don't think so, but as I said, I could be wrong.

N.B: the version in the how-to uses radius, which is not part of the
open source Community Version.  However, we have a PHP network client
that could be integrated with the Community version.  Also, since I
wrote that how-to for SM, we have added mutual https authentication
that prevents network-based MITM attacks by validating the ssl cert
for the user. You can find out more about that
here:http://www.wikidsystems.com/learn-more/technology/mutual_authentication.

Nick

>
>>> OR are there other suggestions?  TIA
>>
>> A plugin hooked into the logout page of SquirrelMail could be used to
>> create a new password if the system allows it, but I don't have any
>> suggestions right now on how to do that in practise.
>
> I actually have a plugin sitting around that creates OTPs from within
> the SM interface (they are ONLY *SquirrelMail* OTPs); the somewhat
> insecure part of the puzzle being that SM actually takes the user's
> real password and stores it in an encrypted file.  The encryption is
> decent (any mcrypt-supported algorithm works), but it's still always
> an iffy proposition for an application to store user passwords.  This
> particular plugin is years old and needs a lot of face-lifting before
> it would be ready for use.
>
> -
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse012070mrt/direct/01/
> -----
> squirrelmail-users mailing list
> Posting guidelines: http://squirrelmail.org/postingguidelines
> List address: squirrelmail-users@lists.sourceforge.net
> List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
> List info (subscribe/unsubscribe/change options): 
> https://lists.sourceforge.net/lists/listinfo/squirrelmail-users
>



-- 
-- 
Nick Owen
WiKID Systems, Inc.
404.962.8983
http://www.wikidsystems.com
Commercial/Open Source Two-Factor Authentication

-
This SF.net email is sponsored by: Microsoft 
Defy all challenges. Microsoft(R) Visual Studio 2008. 
http://clk.atdmt.com/MRT/go/vse012070mrt/direct/01/
-
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@lists.sourceforge.net
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): 
https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Folder Sizes

2003-08-22 Thread Nick Bartos

you could set it in the default_pref file.  that won't help existing users
that already have a pref file, but any new pref files created use that as
a template.

if you want to set it in existing files, you could write a script to add
in the right line to all the config files.


> Dear All,
>
> We have SM 1.4.1 running quite well on RH7.2 although
> after fixing a few things here and there like
> attachments problem and 'reply' problem.
>
> Just recently we installed the folder sizes plugin and
> its working OK. However for the folder sizes link to
> be displayed in the left frame, the user has to go to
> the Options page to change the folder preferences.
> What we would prefer is that by default the folder
> sizes link should be displayed when a user just logs
> in without first changing in the options page.
> Any way out?
>
> Thanks in advance
>
> Bennett Kankuzi
> Malawi
>
>
>
> __
> Do you Yahoo!?
> Yahoo! SiteBuilder - Free, easy-to-use web site design software
> http://sitebuilder.yahoo.com
>
>
> ---
> This SF.net email is sponsored by: VM Ware
> With VMware you can run multiple operating systems on a single machine.
> WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
> at the same time. Free trial click
> here:http://www.vmware.com/wl/offer/358/0
> --
> squirrelmail-users mailing list
> List Address: [EMAIL PROTECTED]
> List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id=2995
> List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users
>



---
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
--
squirrelmail-users mailing list
List Address: [EMAIL PROTECTED]
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id)95
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Login questions.....

> Nick Fisher said:
>> Hi All,
>>   I'm trying to figure out if it's possable to login, start a session
>> and
>> redirect to a perticular page in one action.
>
> Have you looked at the Startup Folder plugin?:
> http://www.squirrelmail.org/plugin_view.php?id=197
>
>
As far as I can see that plugin just changes the folder that is displayed
when you login. You also have to precofigure where it's going to put
you so it's really not much use for what I'm trying to do.

Basicly I want to be able to login to a SquirrelMail account and goto a
perticular URL (Compose, Mailbox, Read a message) in a single POST action.
I was hoping that there was some way I could craft a POST or a URL with
the username and password that would take me directly to the page I
specify (in the URL or POST) rather than just being droped at webmail.php.
If anyone has any crazy ideas I'd love to hear them.

  Nick


---
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click
--
squirrelmail-users mailing list
List Address: [EMAIL PROTECTED]
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id)95
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Login questions.....

>> As far as I can see that plugin just changes the folder that is
>> displayed
>> when you login. You also have to precofigure where it's going to put
>> you so it's really not much use for what I'm trying to do.
> Yes, I wasn't suggesting that it was a ready-made solution for your
> requirement. I just thought that you might be able to use its code as a
> base to modify.
I was *hoping* not to have to get into the code :(

Are you suggesting that I write a custom plugin because you know that
there is no way of doing this currently?
Frankly it seems to me that the easyist thing to do would be to patch
redirect.php so that it takes an additional form var that can override the
redirect_url. However I'm quite ham fisted when it comes to PHP. I'm more
of a python/perl guy. If I'm saying anything daft here please feel free to
correct me.

  Nick


---
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click
--
squirrelmail-users mailing list
List Address: [EMAIL PROTECTED]
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id)95
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Login questions.....

>>>>As far as I can see that plugin just changes the folder that is
>>>>displayed
>>>>when you login. You also have to precofigure where it's going to put
>>>>you so it's really not much use for what I'm trying to do.
>>>
>>>Yes, I wasn't suggesting that it was a ready-made solution for your
>>>requirement. I just thought that you might be able to use its code as a
>>>base to modify.
>> I was *hoping* not to have to get into the code :(
> I think you might have to.
Dangnammit.

>> Are you suggesting that I write a custom plugin because you know that
>> there is no way of doing this currently?
>> Frankly it seems to me that the easyist thing to do would be to patch
>> redirect.php so that it takes an additional form var that can override
>> the
>> redirect_url.
> There are two quick and dirty ways of doing this that I can see. You
> want to go to the compose page right?
I want to be able to dynamically change the page I end up at using the
POST/URL. The compose page is as good a place as any to start ;)

> In redirect.php change:
>
>$redirect_url = 'webmail.php';
> to
>$redirect_url = 'webmail.php?right_frame=compose.php';
Frankly I was thinking something more along the lines of:
$redirect_url = 'compose.php'
So that *just* the compose page opens without the left hand menu frame.

Perhaps I could do something like this around line 137 of redirect.php

sqGetGlobalVar('other_url', $other_url)
if($other_url != '') (
  $redirect_url = $other_url;
) else (
  ... the normall $redirect_url setting code ...
)

Then in all I have to do is POST to redirect.php with the
'login_username', 'secretkey' (password) and 'other_url'..?
Though I'm not really sure that sqGetGlobalVar is the right function to
use. To get the form var. I have *NO* idea what I'm doing in the
SquirrelMail code :(

> OR
>
> In webmail.php add:
>
>$right_frame = 'compose.php';
>
> around line 112 or so, just after the comments about how to call
> webmail.php.
Again this is kinda a static thing and would mess up the general operation
of SquirrelMail. All I want to do is put in a shortcut way of logging in
and getting to a perticular page.

>> However I'm quite ham fisted when it comes to PHP. I'm more
>> of a python/perl guy.
> If you can code in perl, you you shouldn't have too much trouble with php.
Heh No php doesn't look all that bad and I've been meaning to get into
it more. It's just *yet annother* set of syntax, core functions and
methodoligy to learn.

> Hope this helps,
It does indeed. You seem to be saying that what I want to do will require
coding that's question one answered ;)

Now all I have to do is figure out the easist and most un-intrusive way of
getting this done. Hopefully in some manner that the maintainers will be
happy to roll into the next release so that I'm not forever patching new
releases. If you can give me any pointers there it would be most handy!

Many thanks

  Nick


---
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click
--
squirrelmail-users mailing list
List Address: [EMAIL PROTECTED]
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id)95
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Login questions.....

>>> Nick Fisher said:
>>>> Hi All,
>>>>   I'm trying to figure out if it's possable to login, start a session
>>>> and
>>>> redirect to a perticular page in one action.
>>>
>>> Have you looked at the Startup Folder plugin?:
>>> http://www.squirrelmail.org/plugin_view.php?id=197
>>>
>>>
>> As far as I can see that plugin just changes the folder that is
>> displayed
>> when you login. You also have to precofigure where it's going to put
>> you so it's really not much use for what I'm trying to do.
>>
>> Basicly I want to be able to login to a SquirrelMail account and goto a
>> perticular URL (Compose, Mailbox, Read a message) in a single POST
>> action.
>
> Do you want to remove frame that is generated by src/webmail.php?
>
Er yes but that's not all. I'm trying to open a single page without
rest of the frame set, but do it in a single action. For example I would
like to be able to send a POST (containing Username and pass info) to
redirect.php, and rather than being sent to '/webmail.php' be sent to
'/right_main.php?PG_SHOWALL=0&sort=0&startMessage=1&mailbox=INBOX' or
perhaps '/compose.php?mailbox=INBOX'. Is that any clearer?

  Nick



---
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click
--
squirrelmail-users mailing list
List Address: [EMAIL PROTECTED]
List Archives:  http://sourceforge.net/mailarchive/forum.php?forum_id)95
List Info: https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: [SM-USERS] Login questions.....