headers
Cherry, Steven | 4 Dec 2007 16:19

fetchmail IMAP

I'm using fetchmail against an AD and it worked fine until yesterday.  I assume the server guys made some
change and now I cannot get my mail.  Also fails when I use NTLS

my rc file:
-----
set logfile    /tmp/fetchmail.log
defaults
         timeout 30
         keep
         fetchall 
poll DNP-server.us.ad.gannett.com protocol IMAP auth password
        username 'us\/scherry'
        password secret
-----

my -vv output
-----
fetchmail: 6.3.6 querying DNP-LCLCI02.us.ad.gannett.com (protocol IMAP) at Tue 04 Dec 2007 10:14:48 AM
EST: poll started
fetchmail: Trying to connect to 10.5.1.76/143...connected.
fetchmail: IMAP< * OK Microsoft Exchange Server 2003 IMAP4rev1 server version 6.5.7638.1
(DNP-LCLCI02.us.ad.gannett.com) ready.
fetchmail: IMAP> A0001 CAPABILITY
fetchmail: IMAP< * CAPABILITY IMAP4 IMAP4rev1 IDLE LOGIN-REFERRALS MAILBOX-REFERRALS NAMESPACE
LITERAL+ UIDPLUS CHILDREN AUTH=NTLM
fetchmail: IMAP< A0001 OK CAPABILITY completed.
fetchmail: Protocol identified as IMAP4 rev 1
fetchmail: DNP-LCLCI02.us.ad.gannett.com: opportunistic upgrade to TLS failed, trying to continue
fetchmail: IMAP> A0002 NOOP
fetchmail: IMAP< A0002 OK NOOP completed.
(Continue reading)

Permalink | Reply | 1 comment |
headers
Matthias Andree | 4 Dec 2007 17:28
Picon
Picon

Re: fetchmail IMAP

Cherry, Steven schrieb:
> I'm using fetchmail against an AD and it worked fine until yesterday.  I assume the server guys made some
change and now I cannot get my mail.  Also fails when I use NTLS
> 
> my rc file:
> -----
> set logfile    /tmp/fetchmail.log
> defaults
>          timeout 30
>          keep
>          fetchall 
> poll DNP-server.us.ad.gannett.com protocol IMAP auth password
>         username 'us\/scherry'
>         password secret
> -----
> 
> my -vv output
> -----
> fetchmail: 6.3.6 querying DNP-LCLCI02.us.ad.gannett.com (protocol IMAP) at Tue 04 Dec 2007 10:14:48
AM EST: poll started

Try 6.3.8 and see if that makes any difference.

Given you're working in an intranet, you could try to suppress the
automatic TLS negotiation by adding "sslproto ssl3" to your configuration
and see if that helps.

If it doesn't, please ask the server guys what they changed recently,
perhaps we can then figure what to do.
(Continue reading)

Permalink | Reply | 0 comments |
headers
michael | 4 Dec 2007 21:16

fetchmail props

I just need to simply pull email from an MS Exchange POP account, write
those individually to disk for processing by an archiving system.  The
questions I have are:

1]  Would maildir be the format I want?
2] Using this config:

poll SERVERNAME protocol PROTOCOL username NAME password PASSWORD

Where would the emails download to?
3]  Anyone have any specific configuration for what I need?

Thanks!
Michael
Permalink | Reply | 1 comment |
headers
Rob MacGregor | 4 Dec 2007 22:32
Picon
Gravatar

Re: fetchmail props

On Dec 4, 2007 8:16 PM,  <michael <at> willowtreeinteractive.com> wrote:
> I just need to simply pull email from an MS Exchange POP account, write

You have, of course, read the FAQ to do with Exchange:

  http://www.fetchmail.info/fetchmail-FAQ.html#S2

> those individually to disk for processing by an archiving system.  The
> questions I have are:
>
> 1]  Would maildir be the format I want?

You tell us ;)  Fetchmail neither knows nor cares about the format you
store the email in.  Your choice will depend on what local delivery
mechanism you use.

> 2] Using this config:
>
> poll SERVERNAME protocol PROTOCOL username NAME password PASSWORD
>
> Where would the emails download to?

They would be handed over (as detailed in the man page) to whatever
SMTP server you had listening on port 25 of the system you're running
fetchmail on.

> 3]  Anyone have any specific configuration for what I need?

You don't really give enough detail for specific help.
(Continue reading)

Permalink | Reply | 0 comments |
headers
Andrea Bencini | 5 Dec 2007 10:13
Picon

certificate verification error

I installed fetchmail-6.3.8-3.
 My .fetchmailrc file is:

 poll pop.my.domain timeout 300 protocol pop3 auth password
   user 'myuser' with password 'mypassword' to andrea smtphost 
 localhost/2345

 In maillog file I receive this message:
 pptt fetchmail[6293]: Server certificate verification error: self signed 
 certificate

 What is it?
 Can you help me?
 Thanks
 Andrea
Permalink | Reply | 6 comments |
headers
Rob MacGregor | 5 Dec 2007 10:26
Picon
Gravatar

Re: certificate verification error

On Dec 5, 2007 9:13 AM, Andrea Bencini <andrea.bencini <at> tin.it> wrote:
> I installed fetchmail-6.3.8-3.
>  My .fetchmailrc file is:
>
>  poll pop.my.domain timeout 300 protocol pop3 auth password
>    user 'myuser' with password 'mypassword' to andrea smtphost
>  localhost/2345
>
>  In maillog file I receive this message:
>  pptt fetchmail[6293]: Server certificate verification error: self signed
>  certificate
>
>  What is it?

If you'd looked at the list archive you'd have found many threads on
this, the latest of which is:

https://lists.berlios.de/pipermail/fetchmail-users/2007-August/001167.html

In short, you need identify the certificate's signature and then add
the relevant fingerprint to your .fetchmailrc.

fetchmail -v -v -v -c --nodetach --nosyslog

Then add the fingerprint as "sslfingerprint FINGERPRINT" before the
user line in your .fetchmailrc.

--

-- 
                 Please keep list traffic on the list.
(Continue reading)

Permalink | Reply | 5 comments |
headers
Matthias Andree | 6 Dec 2007 01:30
Picon
Picon

Re: certificate verification error

Rob MacGregor schrieb am 2007-12-05:

> On Dec 5, 2007 9:13 AM, Andrea Bencini <andrea.bencini <at> tin.it> wrote:
> > I installed fetchmail-6.3.8-3.
> >  My .fetchmailrc file is:
> >
> >  poll pop.my.domain timeout 300 protocol pop3 auth password
> >    user 'myuser' with password 'mypassword' to andrea smtphost
> >  localhost/2345
> >
> >  In maillog file I receive this message:
> >  pptt fetchmail[6293]: Server certificate verification error: self signed
> >  certificate
> >
> >  What is it?
> 
> If you'd looked at the list archive you'd have found many threads on
> this, the latest of which is:
> 
> https://lists.berlios.de/pipermail/fetchmail-users/2007-August/001167.html
> 
> In short, you need identify the certificate's signature and then add
> the relevant fingerprint to your .fetchmailrc.
> 
> fetchmail -v -v -v -c --nodetach --nosyslog
> 
> Then add the fingerprint as "sslfingerprint FINGERPRINT" before the
> user line in your .fetchmailrc.

Careful there!
(Continue reading)

Permalink | Reply | 4 comments |
headers
Rob MacGregor | 6 Dec 2007 07:58
Picon
Gravatar

Re: certificate verification error

On Dec 6, 2007 12:30 AM, Matthias Andree <matthias.andree <at> gmx.de> wrote:
>
> Careful there!
>
> The canonical way still is to install the root certificate and perhaps
> (that is, if delegations are present) - the intermediate certificates
> either system-wide or into the directory given with --sslcertpath DIR
> (don't forget to run c_rehash on the directory).

My mistake.  I'd remembered a discussion where the comment had been
that sslfingerprint and downloading the *server* certificate achieved
the same thing, overlooking the other discussion about downloading
root certificates by preference.

--

-- 
                 Please keep list traffic on the list.

Rob MacGregor
      Whoever fights monsters should see to it that in the process he
        doesn't become a monster.                  Friedrich Nietzsche
Permalink | Reply | 3 comments |
headers
Matthias Andree | 6 Dec 2007 17:41
Picon
Picon

Re: certificate verification error

Rob MacGregor schrieb:
> On Dec 6, 2007 12:30 AM, Matthias Andree <matthias.andree <at> gmx.de> wrote:
>> Careful there!
>>
>> The canonical way still is to install the root certificate and perhaps
>> (that is, if delegations are present) - the intermediate certificates
>> either system-wide or into the directory given with --sslcertpath DIR
>> (don't forget to run c_rehash on the directory).
> 
> My mistake.  I'd remembered a discussion where the comment had been
> that sslfingerprint and downloading the *server* certificate achieved
> the same thing, overlooking the other discussion about downloading
> root certificates by preference.

While your assertion is correct (equivalent level of security or rather
insecurity), it does not protect against man-in-the-middle attacks.

The compelling question at hand is: how do you know you're not being
subject to a man-in-the-middle attack while downloading the certificate?

The answer is: you *cannot* know - unless you verify the server
certificate's fingerprint -- which is a rather unusual practice, you'd more
readily find the *root* certificate of the ISP's or institute's
certification authority (CA) for download along with fingerprints, and
verifying *those* by calling the CA is more common.

HTH
Matthias

--

--
(Continue reading)

Permalink | Reply | 2 comments |
headers
Rob MacGregor | 6 Dec 2007 22:35
Picon
Gravatar

Re: certificate verification error

On Dec 6, 2007 4:41 PM, Matthias Andree <matthias.andree <at> gmx.de> wrote:
>
> While your assertion is correct (equivalent level of security or rather
> insecurity), it does not protect against man-in-the-middle attacks.
>
> The compelling question at hand is: how do you know you're not being
> subject to a man-in-the-middle attack while downloading the certificate?
>
> The answer is: you *cannot* know - unless you verify the server
> certificate's fingerprint -- which is a rather unusual practice, you'd more
> readily find the *root* certificate of the ISP's or institute's
> certification authority (CA) for download along with fingerprints, and
> verifying *those* by calling the CA is more common.

Of course, I'd argue that self-signed certificates (which is where
this thread started) are unverifiable by their very nature ;)

Having said that, I'd agree that downloading and installing a CA's
certificate is a cleaner solution, where you can trust that CA.

--

-- 
                 Please keep list traffic on the list.

Rob MacGregor
      Whoever fights monsters should see to it that in the process he
        doesn't become a monster.                  Friedrich Nietzsche
Permalink | Reply | 1 comment |

Gmane