Unix Web Hosting for Developers

set tls-cipher-list = bf,des,des3 ………………………………………………………………………………………. These tls-cipher-list settings are the cryptographic ciphers that your system will support. You can get a complete list of ciphers your system supports by running openssl list-cipher-commands. The preceding example supports most email clients. ………………………………………………………………………………………. set tls-server-cert-file = /usr/local/etc/qpopper/server.cert ………………………………………………………………………………………. This tls-server-cert-file setting specifies the location of your signed certificate file. We created a signed server certificate in the previous chapter. After setting these options, you should be all set to provide pop3ssl services. This is by far the most preferable method, and easy enough to do. Qpopper Security Qpopper has a questionable security record, but it has undergone an extensive code audit and is now as secure as any POP3 server daemon. You still need to keep up on security advisories, however, just as you would for any program that transmits user data across the network. Since qpopper runs out of inetd, you can use TCP Wrappers to help secure it. [3]You can do something called a “brute force attack,” where you try to find a text string that has a cryptographic collision with the password. This takes a lot of CPU time, and a lot of time, and is utterly inappropriate for a server protocol. 334

Note: If you are looking for good and high quality web space to host and run your application check Lunarwebhost PHP Web Hosting services

Listing Users If a user runs the following command, it tells him whether he is in the APOP user database. If root runs this as qpopauth -list ALL, it lists every APOP user: ………………………………………………………………………………………. # qpopauth -list ………………………………………………………………………………………. Enabling APOP When you set up APOP, you need to decide whether plain-text POP3 will still be permitted. If you want to allow people to use either plain POP3 or APOP, you need to change the clear-text-password option. (The default lets people use plain-text passwords only if they are not set up as APOP users.) Use the set clear-text-password option in your qpopper configuration file to require the use of APOP. ………………………………………………………………………………………. set clear-text-password = always ………………………………………………………………………………………. Supporting APOP Allowing both APOP and plain POP3 can cause password confusion because the APOP user database and /etc/master.passwd are not synchronized by anything except administrator intervention. When a user calls and says that she can’t get her mail, you’ll have to find out if she’s using APOP or POP3. The user probably won’t know, so you’ll have to walk her through her mail client to find out, or just change both passwords to a known value. APOP is a better idea all around. A better idea still is pop3ssl. Configuring Pop3ssl The POP3-over-SSL process is similar to the default POP3 protocol. Instead of sending a username, however, the client sends a request for SSL. If your server can grant it, the remaining steps of the process are all encrypted. All of the performance options are set as if you’re running standard POP3. You need to set several configuration options to use pop3ssl, however, as follows. ………………………………………………………………………………………. set clear-text-password = tls ………………………………………………………………………………………. With this clear-text-password option, you can use clear-text passwords if you’re using SSL encryption. A user could use APOP or pop3ssl, but not vanilla POP3. ………………………………………………………………………………………. 333

Note: If you are looking for good and high quality web space to host and run your application check Lunarwebhost Unix Web Hosting services

APOP Setup APOP uses a challenge-response system. When a user connects to the POP3 server, the server takes the user’s known password and computes a challenge based upon it. This challenge is sent to the client. The client takes the challenge, combines it with the password, computes a response, and sends it back to the server. The server, meanwhile, has performed the same calculation and it compares the client’s response to its own result. If they match, the client has proven that it has the password. Mail download is permitted. Why go to all this trouble? Well, the password itself has never passed over the network. This eliminates any chance for password theft via qpopper requests. Web browsing, telnet, and so on, all give other opportunities for password theft. APOP Password Database Since APOP computes a shared secret based on the user’s password, qpopper must have access to the user’s password. In UNIX, password encryption is a one-way trip; even given the /etc/master.passwd file, you cannot extract the password.[3]. APOP therefore requires a separate username and password database. This APOP user database is kept in /usr/local/etc/qpopper/pop.auth.db, and it should only be readable by root. You administer the APOP user database with qpopauth(8). Before you can do anything, you must initialize the database: ………………………………………………………………………………………. # qpopauth -init ………………………………………………………………………………………. Once you have a database, you can use qpopauth to manage users. Adding Users This command adds a user to the database: ………………………………………………………………………………………. # qpopauth -user username ………………………………………………………………………………………. You’ll be prompted for a password. If the user does not exist on the main system, qpopauth will not let you add the user. Deleting Users The following command deletes the specified user from the database: ………………………………………………………………………………………. # qpopauth -delete username ………………………………………………………………………………………. 332

Note: If you are looking for good and high quality web space to host and run your application check Lunarwebhost Unix Web Hosting services

Username Case If you have a variety of users, some of them will type their username in all capital letters. That’s how usernames appear in the movies, after all! By putting the following line in your configuration, usernames received from clients are transformed into all lowercase before qpopper attempts to authenticate them. ………………………………………………………………………………………. set downcase-user = true ………………………………………………………………………………………. This can reduce your technical support calls. Mail Spool Handling A POP3 client can choose to either copy all messages from the server, download and delete all messages from the server, or delete some messages from the server while leaving the rest. The first two choices (leave everything and delete everything) are typical of core mail-server functionality. The third, a mix of saving and deleting, is a lot of work, and it is set with the following line: ………………………………………………………………………………………. set server-mode = false ………………………………………………………………………………………. Server mode assumes that the client will either save all its mail or delete all its mail. This makes qpopper much faster, and reduces server disk I/O. If you enable server mode, you greatly increase qpopper’s efficiency. You also make some promises to qpopper when you enable server mode, however. Qpopper will assume that mail is only delivered to clients by qpopper. This is where the “mixing local mail readers and POP3″ problem appears. If you use a local mail reader to check mail on an account, and someone pops that account’s mail while you’re reading it, you can damage users’ mail. You don’t want to do that. If you don’t combine POP3 and local mail clients, and don’t read your users’ mail, setting this to true is perfectly safe and will improve performance. Reducing Disk Activity If you set the following option, you will decrease your disk activity by a third: ………………………………………………………………………………………. set fast-update = false ………………………………………………………………………………………. This setting doesn’t mix with local mail readers, however. You will also break UNIX programs that notify you of new mail on the UNIX system. This is perfectly safe on a POP-only mail server. 331

Note: If you are looking for good and high quality web space to host and run your application check Lunarwebhost Unix Web Hosting services

Config Files and Inetd The obvious place on a FreeBSD system to put the qpopper configuration file is under /usr/local/etc/qpopper. By default, only root can access the qpopper directory. More advanced qpopper implementations will also store user databases and security certificates in this directory. To tell qpopper to take its settings from a file in this directory, use the -f flag. You can make all your other changes in the configuration file, and never have to touch /etc/inetd.conf again. This would make your inetd.conf entry look like this (and despite the page width, this is all on one line): ………………………………………………………………………………………. pop3 stream tcp nowait root /usr/local/libexec/qpopper qpopper -s -f /usr/local/etc/qpopper/qpopper.conf ………………………………………………………………………………………. Qpopper.conf Now that you’ve told your system how to run qpopper, you need to create the configuration file. Each configuration statement in qpopper.conf appears on its own line, preceded by the word set. Any of these options can be combined with APOP and pop3ssl. Qpopper Mode The most important option you have is how qpopper is going to work. The following setting controls whether qpopper will accept clear-text passwords, as used in the manual test earlier. ………………………………………………………………………………………. set clear-text-password = default ………………………………………………………………………………………. You have a few different options here. We’re going to look at the most common. By default, qpopper checks to see if the user is set up for APOP. If so, then clear-text passwords are not allowed. If the user is not set up for APOP, then clear-text passwords are permitted. Use this for standard services. Specifying always as the setting means that qpopper will accept clear-text passwords, even if the user is set up for APOP. You might need to use this in an ISP environment; while you’d like the user to use APOP, some users have email clients that simply cannot handle it. Specifying never means that clear-text passwords will not work, even if you’re using pop3ssl. You must use APOP to get your mail. Specifying tls means that clear-text passwords are acceptable if you’re running over an encrypted connection (such as SSL). After all, the entire connection is encrypted! We’ll discuss APOP and POP3 over SSL later (in “APOP Setup” and “Configuring Pop3ssl,” respectively.) 330

Note: If you are looking for good and high quality web space to host and run your application check Lunarwebhost Unix Web Hosting services

support it. While the authentication information is secure, the email itself isn’t. Pop3ssl Pop3ssl is the newest version of the POP3 protocol, as well as funnels, the connection over SSL. This is the most secure type of POP3 service you can have today. We’ll consider each type of POP3 in turn. In order to use either APOP or pop3ssl, you need to have a basic POP3 setup anyway. Qpopper Preconfiguration Questions Before you configure qpopper, you need to settle two questions: What kind of users will you have and will you be using local mail readers? User Types If you’re providing corporate mail services via qpopper, you are ultimately responsible for setting up the clients (or, at best, working with the people who have to set up the clients). You can insist upon things like “All users must type their usernames in lowercase” and “Mail must remain on the server.” You can also insist that they use APOP or pop3ssl instead of default POP3. If you’re providing services for hundreds or thousands of people, you need a configuration that allows more user mistakes and handles a wider variety of email clients. You won’t keep your users long if you insist that they use one of your approved email readers instead of the mail program that they’ve used for years! Local Mail Readers ome users read email locally on the server, using a UNIX-based email client, such as mutt(1) or pine(1). These clients change the users’ mail file directly on the server. If qpopper can safely assume that the mail spool will not change out from underneath it, it can make several optimizations that will greatly improve performance. This isn’t a big deal for systems administrators many sysadmins don’t use POP3, relying instead on ssh and a local mail reader. Some power users might want to use both, however. If you don’t allow the combination of local mail readers and POP3, you can optimize qpopper. Default Qpopper Configuration A raw install of qpopper will give you basic POP3 functionality, as demonstrated earlier. Users will be able to connect and download their mail. You can do various things to improve performance, however, and you can enhance your setup rather easily. Earlier versions of qpopper were configured entirely by options on the command line in /etc/inetd.conf. This worked well when qpopper was a simple program that only supported default POP3. As APOP and pop3ssl became more common, however, command-line configuration became less and less practical. Once the command-line arguments start to wrap around the screen two or three times, you really need to convert your program to use a configuration file. While a vanilla POP3 qpopper install doesn’t need a config file, we’re going to use one. 329

Note: If you are looking for good and high quality web space to host and run your application check Lunarwebhost Cheap Web Hosting services