POP, the postoffice protocol

Description of the pop installation

The pop server is running on doppler.eecs.berkeley.edu. You will need to set up the preferences of your mail reader so that doppler.eecs.berkeley.edu is the incoming and outgoing mail server.

APOP and eudora

1. On doppler, run the popauth command and type in the passwd you want to use. This passwd need not be the same as your Kerberos or regular login passwd. I believe that there is a limit of 8 characters to the passwd.
2. On the machine running Eudora, select the Options choice from under the Tools menu. Find the Incoming Mail icon and select APOP.
3. Set your POP host to doppler.eecs.berkeley.edu.
4. Type Control-M to read mail, then type in your POP passwd from step 1 above.

New users can be added by root or the 'pop' user with the 
following command:

	    popauth -user 

	Or removed with the following command:

	    popauth -delete 

Anyone can add themselves or change their password with the 
following command: 

	    popauth

Installing qpopper

1. Under Solaris, OpenSSL will work much better if you have a /dev/random
   Summary about /dev/random at http://lists.gnupg.org/pipermail/gnupg-devel/2000-May/005156.html
   /dev/random package
2. Install OpenSSL by downloading from http://www.openssl.org
   Usually OpenSSL gets installed in /usr/local/ssl

   cd /export/home/tools/openssl-xxx
   ./config
   make >& make.out &
   tail -f make.out
   make test
   umask 002
   make install
   

3. Download Qpopper from
   http://www.eudora.com/products/unsupported/qpopper/
4. Configure with:

   rm config.cache config.status; ./configure --enable-apop=/etc/pop.auth --with-apopuid=pop --with-openssl=/usr/local/ssl --without-gdbm --enable-debugging=yes
   

5. Note that to use old databases in /etc/pop.auth.dir and /etc/pop.auth.pag you may need to edit config.h and comment out HAVE_GDBM_H

   /* Define if you have the  header file.  */
   /*#define HAVE_GDBM_H 1*/
   

6. If you want to only allow APOP, then edit config.h and add

   #define APOP_ONLY 1
   

   
   APOP uses an encrypted password to log users in, it is much more secure than USER/PASS POP authentication. However, for testing out SSL, do not add #define APOP_ONLY 1 quite yet
7. As root:

   make
   make install
   cp popper/popper /usr/local/sbin/popper-ssl
   

8. Add the following line to /etc/inetd.conf

   spop3 stream tcp nowait root	/usr/local/sbin/popper-ssl -d -t /var/spool/mqueue/pop.log -f /etc/mail/qpopper.config 
   

9. Add the following line to /etc/services

   spop3           995/tcp 			# Pop with SSL
   

10. Use ps -auxgww | grep inetd to figure out the PID of the inetd process and then call kill -1 inetd pid
11. Create /etc/mail/qopper.config:

    set debug
    set tls-support = stls 
    set tls-server-cert-file = /etc/mail/certs/cert.pem 
    set log-facility             = local0
    set tls-support = alternate-port
    set clear-text-password = tls
    set chunky-writes = tls
    

12. Set up certificates, see How do I use TLS/SSL with Qpopper? question in the Qpopper FAQ
    Note that when you get the Common Name question, be sure to type in the fully qualified domain name of the host that is running pop, or else you will get messages about how the certificate does not match the host.

    
        18  mkdir -p -m665 /etc/mail/certs
    
        20  chown root.mail /etc/mail/certs
        21  chmod 660 /etc/mail/certs
        22  /usr/local/ssl/bin/openssl req -new -nodes -out req.pem -keyout /etc/mail/certs/cert.pem
        23  chmod 600 /etc/mail/certs/cert.pem
    
        25  chown root /etc/mail/certs/cert.pem
    
        27  /usr/local/ssl/bin/openssl genrsa -des3 -out ca.key 1024
    
        29  /usr/local/ssl/bin/openssl openssl req -new -x509 -days 365 -key ca.key -out ca.crt
        30  /usr/local/ssl/bin/openssl req -new -x509 -days 365 -key ca.key -out ca.crt
        31  /usr/local/ssl/bin/openssl x509 -req -CA ca.crt -CAkey ca.key -days 365 -in req.pem -out signed-req.pem -CAcreateserial
        35  cat signed-req.pem >> /etc/mail/certs/cert.pem
    

13. Setting up Eudora
    Eudora 5.1 is required to work with SSL. The Eudora 5.1 release notes at http://www.eudora.com/download/eudora/windows/5.1/full_elec/RelNotes.txt cover how to set up SSL
    1. Download Eudora 5.0R from http://depot.berkeley.edu/software/email/epro_downloads.html
    2. Download Eudora 5.1 Updater http://www.eudora.com/email/index.html
    3. The Eudora release notes include the following about SSL

       SSL is implemented on a per personality basis.  In your 
       Personalities window, right-click on a personality that supports SSL.
       
       Under Generic Properties tab, there is a Secure Sockets section 
       where you can specify its usage.  The list includes:
       Never, If Available, Required on Alternate Port, and Required 
       (STARTTLS).  The default is "If Available".
       
       The [Last SSL Info] button will only work if you have been able to 
       send an email with the SSL personality.
       
       Under Incoming Mail tab, there is also a Secure Sockets section with 
       the same options.  You can click on the [Last SSL Info] button to 
       view the Eudora SSL Connection Information Manager.
       
       Note that there is a [Certificate Information Manager] button at the 
       bottom of the dialog.
       
       In the Certificate Information Manager, you can specify which 
       certificates you trust.  You can click on the [Add to Trusted] and 
       [Remove from Trusted] buttons to specify which certificates you trust.
       
       Eudora has provided some Trusted Certificates, but you will have your 
       own certificates too under Server Certificates.
       
       A skull with cross bones represents a certificate that is not trusted.
       A yellow face in the User Trusted Certificates branch will mean that 
       the certificate is trusted.
       If a certificate has expired, then you will see a red backwards L 
       over the icon.
       

    4. Tools -> Option -> Checking Mail should be set to

       Server: doppler.eecs.berkeley.edu
       Configuration: POP
       Authentication Style: Passwords
       Secure Sockets when Receiving: Required, Alternate Port  
       

    5. Note that you will need to add our temporary certificate to list of trusted certificates. To do this, first try to connect to doppler and read email. You will get a 'untrusted certificate' message, but then you will be able to add the certificate in the next step.
    6. Go to Tools -> Options -> Checking Mail -> Last SSL Info -> Certificate Manager and click on the Ptolem Project certificate and then click on Add To Trusted.
    7. Then try downloading email again, it should work.
14. Setting up Outlook Express to use SSL Found these instructions on the net:

    1. Click on "Tools", and select "Accounts"
    2. Click on the "Mail" tab
    3. Select your mail account, and click "Properties"
    4. Click on the "Advanced" tab.
    5. Check "This server requires a secure connection (SSL)" for either/both "Outgoing Mail (SMTP)" and "Incoming Mail (POP3)".
    

15. Debugging
    Debugging messages should appear in /var/spool/mqueue/pop.log
    The ssldump program might be of use

cp popper /usr/local/etc/popper
cp popauth /usr/local/bin/popauth
chown pop /usr/local/bin/popauth
chmod u+s /usr/local/bin/popauth
cp *.8 /usr/local/man/man8

-rwsr-xr-x   1 pop         31672 Dec 22 14:40 /usr/local/bin/popauth*

touch /etc/pop.auth
chown pop /etc/pop.auth
chmod 600 /etc/pop.auth
/usr/local/sbin/popauth -init