OwlCyberSecurity - MANAGER

Edit File: imaprc.txt

/* ======================================================================== * Copyright 1988-2006 University of Washington * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * * ======================================================================== */ .imaprc secrets revealed! Mark Crispin, June 17, 2002 The following information describes the format of the /etc/c-client.cf and ~/.imaprc file. The Columbia MM ~/.mminit file is also read by c-client; however, the only command that ~/.mminit has in common is set keywords. ********************************************************************** * DANGER! BEWARE! TAKE CARE! * ********************************************************************** * * * These files, and this documentation, are for internal UW usage * * only. This capability is for UW experimental tinkering, and most * * emphatically *not* for sorcerer's apprentices at other sites who * * feel that if a config file capability exists, they must write a * * config file whether or not there is any need for one. * * * * This information is subject to change without notice. Commands * * may be added, removed, or altered. The behavior of comamnds may * * change. Do not use any of this information without consulting me * * first. c-client's defaults have been carefully chosen to be right * * for general-purpose and most special-purpose configurations. If * * you tinker with these defaults, all hell may break loose. * * * * This is not an idle threat. There have been several instances of * * people who ignored these warnings and have gotten burned. * * * * Don't even trust this file to work. Many of the things which can * * be changed by this file can also be changed by the application, * * and it is totally unpredictable which will take precedence. It * * all depends upon how the application is coded. Not only that, you * * may cause the application to crash. * * * * In other words, keep your cotton-pickin' hands off my defaults. * * If it crashes and erases your mail, I don't want to hear about it. * * Consider 'em ``mandatory defaults''. Got a nice ring, eh? :-) If * * you must tinker with defaults, play with the .pinerc and pine.conf * * files in Pine. It's got options galore, all supported for you to * * have fun. They're also documented; so well documented, it takes * * two strong men to carry around all the documentation. ;-) ;-) * * * * Joking aside, you really shouldn't be fooling around with this * * capability. It's dangerous, and you can shoot yourself in the * * foot easily. If you need custom changes, you are better off with * * local source code modifications. Seriously. * * * * One last warning: don't believe anything that you read in this * * document. Every effort has been made to ensure that this document * * is incomplete and inaccurate, and I take no responsibility for any * * glimmers of correct information that may, by some fluke, be here. * * * ********************************************************************** The files are read in order: /etc/c-client.cf, ~/.mminit, ~/.imaprc, and an entry in a later file overrides the setting of an earlier file except as noted below. This ordering and overriding behavior may change without notice. Almost all of these facilities can also be set via the mail_parameters() call in the program. Whether the file overrides mail_parameters(), or mail_parameters() overrides the file, is indeterminate. It will vary from program to program, and it may be one way in one version and the other way in the next version. It's completely unpredictable, and so anything you do with these files has to be in complete knowledge of what the version of each program you're running is going to do. This is because the files do something for testing, but the real capability for configurability is put in the program instead. Are you getting the feeling that you shouldn't be messing with these files yet? The very first line of the file MUST start with the exact string "I accept the risk". This ensures that you have checked the file for correctness against this version of the IMAP toolkit. This enable string may change without notice in future versions, and the new string may or may not be accurately described in an updated version of this file. So any time you install software that uses the IMAP toolkit, you need to check the new version against these files (if you have insisted upon creating them in spite of all warnings). If two pieces of software use different versions of the IMAP toolkit with incompatible requirements, one of them won't work. Re-read the warning above about why you should not use these files. Subsequent lines are read from the file one at a time. Case does not matter. Unrecognized commands are ignored. 1) set new-folder-format sets what format new mailboxes are created in. This also controls default delivery via tmail and dmail. a) set new-folder-format same-as-inbox Folder is created using the same mailbox format as INBOX. If INBOX is empty, it defaults to system standard. b) set new-folder-format system-standard This is the default. Folder is created using the wired-in system standard format, which on most UNIX systems is ordinary UNIX /bin/mail format. On SCO systems, this is MMDF. c) set new-folder-format <driver name> Folder is created using the given driver name, e.g. mbx, unix, mmdf, etc. There is no protection against setting this to a silly value (e.g. news, nntp, dummy) and doing so is a great way to screw things up. Setting this to mh does not do what you think it does. Setting this to tenex or mtx isn't particularly useful. 2) set empty-folder-format sets what format data is written into an empty mailbox file using mail_copy() or mail_append(). This also controls default delivery via tmail. a) set empty-folder-format same-as-inbox Data is written using the same mailbox format as INBOX. If INBOX is empty, it defaults to system standard. b) set empty-folder-format system-standard This is the default. Data is written using the wired-in system standard format, which on most UNIX systems is ordinary UNIX /bin/mail format. On SCO systems, this is MMDF. c) set-empty-folder-format <driver name> Data is written using the given driver name, e.g. tenex, unix, mmdf, etc. There is no protection against setting this to a silly value (e.g. news, nntp, dummy) and doing so is a great way to screw things up. Setting this to mh, mbx, or mx does not work. 3) set keywords <word1>, <word2>, ... <wordn> Sets the list of keyword flags (supported by tenex and mtx) to the given list. Up to 30 flags may be given. Since these names correspond to numeric bits, the order of the keywords can not be changed, nor can keywords be removed or inserted (you can append new keywords, up to the limit of 30). Set keywords is a deprecated command. It may not appear in future versions, or it may appear in a changed form. It exists only for compatibility with MM, and should only appear in ~/.mminit and not in the other files. It is likely to disappear entirely in IMAP4. There is no protection against setting these to silly values, and doing so is a great way to cause a crash. 4) set from-widget header-only Sets smart insertion of the > character in front of lines that begin with ``From ''. Only such lines that are also in UNIX mbox header file format will have a > character inserted. The default is to insert the > character in front of all lines which begin with ``From '', for the benefit of legacy tools that get confused otherwise. 5) set black-box-directory <directory name> Sets the directory in which the user's data can be found. A user's folders can be found in a subdirectory of the black box directory named with the user's username. For example, if the blackbox directory is /usr/spool/folders/, user jones' data can be found in /usr/spool/folders/jones/. The user's black-box directory is the location of folders, .mminit, .imaprc, .newsrc, and all other files used by c-client; internally, it sets c-client's idea of the user's ``home directory'', overriding /etc/passwd. This command may not appear in ~/.mminit or ~/.imaprc In black-box mode, it is not permitted to access any folders outside of the user's personal blackbox directory. The breakouts ``/'', ``~'', and ``..'' are not permitted. In order to make this work without crashing, you must set another option which is not listed in this document. There is no protection against setting this to a silly value, and doing so is a great way to cause a crash. 6) set local-host <host name> Sets c-client's idea of the local host name. There is no protection against setting this to a silly value, and doing so is a great way to cause a crash. 7) set news-active-file <file name> Sets the location of the news active file, if it is not in the standard place. It is recommended to use a courtesy symbolic link instead. There is no protection against setting this to a silly value, and doing so is a great way to cause a crash. 8) set news-spool-directory <directory name> Sets the location of the news spool, if it is not in the standard place. It is recommended to use a courtesy symbolic link instead. There is no protection against setting this to a silly value, and doing so is a great way to cause a crash. 9) set news-state-file <file name> Sets the location of the news state file (normally $(USER)/.newsrc). This is not very useful in /etc/c-client.cf because it is a file name. Setting this in /etc/c-client.cf would set all users to the same file as their newsrc, which is probably not what you want. There is no protection against setting this to a silly value, and doing so is a great way to cause a crash. 10) set system-inbox <file name> Sets the location of the "system inbox", if it is not in the standard place. This is the default location of INBOX, or the mail drop point from which mail is snarfed (e.g. in tenex, mtx, mbox, mh formats). This is not very useful in /etc/c-client.cf because it is a file name. Setting this in /etc/c-client.cf would set all users to the same file as their system inbox, which is probably not what you want. There is no protection against setting this to a silly value, and doing so is a great way to cause a crash. 11) set tcp-open-timeout <number> Sets the number of seconds that the TCP routines will block on opening a TCP connection before timing out. If a timeout occurs, the connection attempt is aborted. The default is zero, meaning use the operating system default (75 seconds on most UNIX systems). There is no protection against setting this to an excessively small value, such as 1, and doing so is a great way to cause users extreme grief. 12) set tcp-read-timeout <number> Sets the number of seconds that the TCP routines will block on reading data before calling the timeout routine. If no timeout routine is set by the program, the connection will be aborted on a timeout. The default is zero, meaning infinite. There is no protection against setting this to an excessively small value, such as 1, and doing so is a great way to cause users extreme grief. 13) set tcp-write-timeout <number> Sets the number of seconds that the TCP routines will block on sending data before calling the timeout routine. If no timeout routine is set by the program, the connection will be aborted on a timeout. The default is zero, meaning infinite. There is no protection against setting this to an excessively small value, such as 1, and doing so is a great way to cause users extreme grief. 14) set rsh-timeout <number> Sets the number of seconds that the rsh routines will block on opening an rimapd connection before timing out. If a timeout occurs, the rsh connection attempt is aborted. A zero timeout will disable rsh. The default is 15 seconds. There is no protection against setting this to an excessively small value, such as 1, and doing so is a great way to cause users extreme grief. 15) set maximum-login-trials <number> Sets the number of iterations of asking the user, via mm_login(), for a user name and password, before cancelling the attempt. The default is 3. There is no protection against setting this to zero, and doing so is a great way to cause users extreme grief. 16) set lookahead <number> Sets the number of envelopes that are looked ahead in IMAP, in mail_fetchstructure(). This is based on the guess that in such operations as drawing browser lines, if you get data for message n you are likely to want it for message n+1, n+2,... in short order. Lookahead preloads the c-client cache and saves unnecessary RTTs. The default is 20, a good number for a browser on a 24x80 screen, and small enough to usually have no significant real-time difference from a single message fetch. Setting it to 0 turns off lookahead. There is no protection against setting this ridiculously high and incurring performance penalties as a result. 17) set prefetch <number> Sets the number of envelops which are automatically fetched for the messages which match in a search. This is based on the guess that in a browser that is "zoomed" on the results of a search, you are likely to want the envelope data for each of those messages in short order. Prefetching reloads the c-client cache, saves unnecessary RTTs, and avoids loading undesired envelopes due to lookahead (see above). The default is 20. Setting it to 0 turns off prefetch. There is no protection against setting this ridiculously high and incurring performance penalties as a result. 18) set close-on-error <number> If non-zero, IMAP connections are closed if an EXAMINE or SELECT command fails. Otherwise, they are left half-open, and can be used again to select some other mailbox. The mailbox name in the stream is set to {serverhost}<no_mailbox> The default is zero (do not close on error). 19) set imap-port <number> Set the TCP/IP contact port to use for IMAP. This overrides the wired-in setting and the setting from /etc/services, and can in turn be overridden by an explicit user specification in the mailbox name, e.g. {serverhost:143}foo The default is zero (use setting from /etc/services or the wired-in setting (143). There is no protection against setting this to a silly value, and doing so is a great way to cause users extreme grief. 20) set pop3-port <number> Set the TCP/IP contact port to use for POP3. This overrides the wired-in setting and the setting from /etc/services, and can in turn be overridden by an explicit user specification in the mailbox name, e.g. {serverhost:110/pop3} The default is zero (use setting from /etc/services or the wired-in setting (110). There is no protection against setting this to a silly value, and doing so is a great way to cause users extreme grief. 21) set uid-lookahead <number> Sets the number of UIDs that are looked ahead in IMAP in mail_uid(). Lookahead preloads the c-client cache and saves unnecessary RTTs. The default is 1000, small enough to usually have no significant real-time difference from a single message UID fetch. Setting it to 0 turns off lookahead. There is no protection against setting this ridiculously high and incurring performance penalties as a result. 22) set mailbox-protection <number> Set the default protection for newly-created mailbox files. The default is 384. There is no protection against setting this to a silly value, and doing so is a great way to screw things up massively. 23) set directory-protection <number> Set the default protection for newly-created directories. The default is 448. There is no protection against setting this to a silly value, and doing so is a great way to screw things up massively. 24) set lock-protection <number> Set the default protection for lock files The default is 438, which is necessary if locks are to be respected by processes running as other UIDs. There is no protection against setting this to a silly value, and contrary to what you may think just about any value other than 438 turns out to be a silly value. 25) set disable-fcntl-locking <number> This only applies to SVR4 systems. If non-zero, fnctl() locking is not attempted. In the past, this was used to avoid locking NFS files. If NFS is involved, the evil lockd/statd daemons get invoked. These daemons supposedly work over NFS, but really don't. You probably don't really want to do this, though, because now the flock() emulator (which calls fcntl()) now checks to see if the file is accessed via NFS and no-ops the lock. This is compatible with BSD. Disabling fcntl() locking loses a great deal of locking protection on local files as well as NFS files (which now never have locking protection). The default is zero (fcntl() locking is enabled). 26) set lock-EACCES-error <number> If non-zero, a warning message is given if an attempt to create a lock file fails. Otherwise, EACCES is treated as a "silent failure", and it proceeds without trying to use the lock file. This is for the benefit of users on systems with paranoid /usr/spool/mail protections which don't let users create /usr/spool/mail/$(USER).lock files; these unfortunate users would be harassed with a flood of error messages otherwise. The problem is that on SVR4, if EACCES remains disabled and fcntl() locking is also disabled, then there is no locking at all which is doubleplus-ungood. If the site is paranoid on /usr/spool/mail protections AND if there is no fcntl() locking (SVR4) or usable flock() locking (e.g. NFS), then there is no way to win. Find a different system to use. The default is non-zero (report EACCESS as an error). 27) set list-maximum-level <number> Sets the maximum depth of recursion that a * wildcard list will go down the directory tree. 0 means that no recursion is permitted, and * becomes like %. The default is 20. There is no protection against setting this to a ridiculously high value. Since LIST will follow symbolic links, it can effectively recurse infinitely, until the name strings get large enough that some name limit is exceeded. 28) set anonymous-home-directory <directory name> Sets the location of the anonymous home directory, if it is not in the standard place. It is recommended to use a courtesy symbolic link instead. There is no protection against setting this to a silly value, and doing so is a great way to cause a crash. 29) set chroot-server <number> This option is for closed server systems only. If defined, a chroot() call to the user's home directory is done as part of the login process. This has the effect of preventing access to any files outside of the user's home directory (including shared mailboxes). Shared mailboxes with other users can't possibly work with this option, because there is no way to export lock information to other users. This should be done ONLY on systems which do not permit users to have shell access This option should NEVER(!!) be set if users are allowed shell access. Doing so actually makes the system *less* secure, since the user could create an etc subdirectory which would be treated as real /etc by such programs as /bin/su. The default is zero (don't do chroot). This option is strongly *NOT* recommended. 30) set disable-automatic-shared-namespaces <number> Never look up the "ftp", "imappublic", and "imapshared" users as posssible home directories for the #ftp, #public, and #shared namespaces. On some systems (reportedly including AIX 4.3.3) getpwnam() of an unknown user name is horrendously slow. Note that this does not remove the #ftp, #public, and #shared namespaces, and they can still be set up by other means. The default is zero (shared namespaces are automatic). 31) set advertise-the-world <number> Include the UNIX root as a shared namespace. This is generally a bad idea, since certain IMAP clients (names withheld to protect the guilty) will take this as license to download the entire filesystem tree. The default is zero (don't advertise the world). 32) set mail-subdirectory <subdirectory name> Change the default connected directory from the user's home directory to the named subdirectory of the user's home directory. For example, setting MAILSUBDIR="mail" will cause the POP2 and IMAP servers to connect to the user's ~/mail subdirectory. This is equivalent to the env_unix.c edit described in Example 2 of the CONFIG file. Note that if the subdirectory does not exist, the result is undefined. It is probably an extremely bad idea to set this unless you can guarantee that the subdirectory exists for all users. If you can not guarantee this, then you should leave the default as the user's home directory and allow them to configure a personal default in their IMAP client. The default is not to use any subdirectory. 33) set allow-user-config <number> Allow users to use ~/.imaprc and ~/.mminit files. The default is zero (don't allow user config files). 34) set allow-reverse-dns <number> By default, the servers (ipop[23]d and imapd) will do gethostbyaddr() on the local and remote sockets so that imapd can identify itself properly (this is important when the same CPU hosts multiple virtual hosts on different IP addresss) and also includes the client's name when it writes to the syslog. There are also client gethostbyaddr() calls, used primarily by authentication mechanisms. Setting this option to zero disables all gethostbyaddr() calls. The returned "host name" string for the socket is just the bracketed [12.34.56.78] form, as if the reverse DNS lookup failed. WARNING: Some authentication mechanisms, e.g. Kerberos V, depend upon the host names being right, and if you set this option, it won't work. You should only do this if you are encountering server performance problems due to a misconfigured DNS, e.g. long startup delays or client timeouts. The default is non-zero (allow reverse DNS). 35) set disable-plaintext <number> Disable plaintext password authentication (LOGIN command, AUTH=LOGIN, and AUTH=PLAIN). The default is zero (allow plaintext authentication). 36) set trust-dns <number> By default, host names are canonicalized via gethostbyname() for everything except for SSL certificate validation. This can represent a security bug due to DNS spoofing, but is more likely to deliver results that users expect. It also may be necessary for SASL authentication to work right (e.g. generating a correct name for a Kerberos service principal) if the name entered by the user is a CNAME or not a fully-qualified domain name. If trust-dns is set to zero, no host name canonicalization is done. The user's actual entered name is used for SASL authentication and will appear in the mailbox name of the open stream. The default is non-zero (do DNS canonicalization). 37) set sasl-uses-ptr-name <number> By default, if trust-dns is set, the host names used in authentication (e.g. to generate a Kerberos service principal) are canonicalized via gethostbyaddr() instead of by gethostbyname(). If gethostbyaddr() fails the gethostbyname() canonicalization is used. This represents an additional security bug due to DNS spoofing, over and above trust-dns. It also adds an additional DNS query to starting a session. It is necessary for sites which implement a server cluster with multiple A records for a cluster name (instead of a CNAME) but each cluster member has a unique PTR record which it expects for a Kerberos service principal. If sasl-uses-ptr-name is set to zero and trust-dns is set non-zero, the gethostbyname() canonicalized name is used for SASL authentication. The setting of sasl-uses-ptr-name is irrelevant if trust-dns is set to zero. The default is non-zero (use name from PTR record for SASL). 38) set network-filesystem-stat-bug <number> By default, traditional UNIX mailbox files are only closed and reopened at checkpoint and expunge time. This ensures that, prior to rewriting the file, that any cached stat() data from a network filesystem is updated with current data. Very old versions of NFS, and reputedly also AFS, can get into a state in which the cached stat() data stays out-of-date, even across a close and reopen of the file. If network-filesystem-stat-bug is set non-zero, then the mailbox file is closed and reopened at ping time as a workaround for this bug in these network filesystems. This means that in imapd, the mailbox file is closed and reopened for every IMAP command. This is obviously something that should be avoided unless absolutely necessary. NFS and AFS are terrible ways to distribute mail. You use use IMAP servers with a local disk instead. The default is zero (only close/reopen at checkpoint and expunge time). Setting this option is a great way to ruin your system's performance. 39) set restrict-mailbox-access <option> <option> ... <option> This option is for closed server systems only. It is less extreme than chroot-server, and allows selective restriction of what mailbox named users can use. The existing options are: root access not permitted to names starting with "/" otherusers access not permitted to other users' names; this should normally be used in conjunction with "root", otherwise another user's names can be accessed via a root name. all all of the above Setting any combination of options also disables access to superior directories via "..". This should be done ONLY on systems which do not permit users to have shell access The default is no restrictions.