popa3d-users - Re: Maildir support

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Mon, 9 Sep 2002 17:10:42 +0200
From: Peter van Dijk <peter@...aloss.nl>
To: popa3d-users@...ts.openwall.com
Subject: Re: Maildir support

On Mon, Sep 09, 2002 at 10:01:00AM -0400, Cory Visi wrote:
> I am willing to do a patch for now. Maybe something you can audit when you
> have time.
> 
> Can anyone recommend a particularly clean/secure implementation
> of Maildir-style mbox access? I looked at the Pine maildir.c and it's
> pretty sloppy. I figure reusing the code is a better approach than
> starting from scratch.

The pine maildir-implementation is severely broken. So is procmail's
implementation (and combine they in fact cause problems). Also note
that maildir.c is an unsupported add-on to Pine - the Pine developers
refuse to include Maildir support.

I have audited some maildir-implementations (regarding delivery, that
is). You can find the results at
http://www.dataloss.nl/breakage/maildir/, which also explains some of
the details.

The qmail popper (qmail-pop3d, not qpopper) is a very good
implementation.

If you have any questions, feel free to ask me (although I'm sure
you're welcome to do that on-list), and I'd be happy to audit your
implementation for compliance to the Maildir specification. 

Greetz, Peter
-- 
peter@...aloss.nl  |  http://www.dataloss.nl/  |  Undernet:#clue