smtpmail authentication again

smtpmail authentication again

[Richard Riley]

I have more than one gmail account. I want to use smtpmail but with
account specific authinfo details. As usual I have something of the form

,----
|    (add-to-list 'gnus-secondary-select-methods
|                 '(nnimap "acc1"
|                          (nnir-search-engine imap)
|                          (nnimap-address "imap.gmail.com")
|                          ))
|    (add-to-list 'gnus-secondary-select-methods
|                 '(nnimap "acc2"
|                          (nnir-search-engine imap)
|                          (nnimap-address "imap.gmail.com")
|                          ))
`----

reading mail isnt an issue: a .authinfo.gpg extract is:

,----
| machine acc1 login id1 password ****
| machine acc2 login id2 password ****
`----

There are numerous complex hacks/howtos out there which swap smtp
authinfo based on from address etc, but with all the recent changes I am
wondering if its now built in somehow?

Any example of using smtp from gnus directly using more than  one smtp
server appreciated. One working but horrendously complicated way is
using something like:-

,----
|  ;; (defun set-smtp (mech server port user password)
|  ;;   "Set related SMTP variables for supplied parameters."
|  ;;   (setq smtpmail-smtp-server server
|  ;;         smtpmail-smtp-service port
|  ;;         smtpmail-auth-credentials (list (list server port user password))
|  ;;         smtpmail-auth-supported (list mech)
|  ;;         smtpmail-starttls-credentials nil)
|  ;;   (message "Setting SMTP server to `%s:%s' for user `%s'."
|  ;;            server port user))
|  
|  ;; (defun set-smtp-ssl (server port user password &optional key cert)
|  ;;   "Set related SMTP and SSL variables for supplied parameters."
|  ;;   (setq starttls-use-gnutls t
|  ;;         starttls-gnutls-program "gnutls-cli"
|  ;;         ;; TODO: Add this to the server parameters
|  ;;         ;; starttls-extra-arguments nil
|  ;;         smtpmail-smtp-server server
|  ;;         smtpmail-smtp-service port
|  ;;         smtpmail-auth-credentials (list (list server port user password))
|  ;;         smtpmail-starttls-credentials (list (list server port key cert)))
|  ;;   (message
|  ;;    "Setting SMTP server to `%s:%s' for user `%s'. (SSL enabled.)"
|  ;;    server port user))
|  
|  ;; (defun change-smtp ()
|  ;;   "Change the SMTP server according to the current from line."
|  ;;   (interactive)
|  ;;   (save-excursion
|  ;;     (loop with from = (save-restriction
|  ;;                         (message-narrow-to-headers)
|  ;;                         (message-fetch-field "from"))
|  ;;           for (auth-mech address . auth-spec) in smtp-accounts
|  ;;           when (string-match address from)
|  ;;           do (cond
|  ;;               ((memq auth-mech '(cram-md5 plain login))
|  ;;                (return (apply 'set-smtp (cons auth-mech auth-spec))))
|  ;;               ((eql auth-mech 'ssl)
|  ;;                (return (apply 'set-smtp-ssl auth-spec)))
|  ;;               (t (error "Unrecognized SMTP auth. mechanism: `%s'." auth-mech)))
|  ;;           finally (error "Cannot infer SMTP information."))))
|  
|  ;; (setq message-sendmail-envelope-from 'header)
|  ;; (add-hook 'message-send-hook 'change-smtp)
|  
|  ;; (setq smtp-accounts '(
|  ;;                       (ssl "riley" "smtp.gmail.com" "587"
|  ;;                            "rileyrg@gmail.com" nil)
|  ;;                       (ssl "shamrock" "smtp.gmail.com" "587"
|  ;;                            "shamrockirishbar@gmail.com" nil)
|  ;; ))
`----

Could it be a lot easier now. Im using the gnus what comes
with bzr emacs 24.

regards

r.

Re: smtpmail authentication again

[Lars Magne Ingebrigtsen]

Richard Riley <rileyrg@gmail.com> writes:

> There are numerous complex hacks/howtos out there which swap smtp
> authinfo based on from address etc, but with all the recent changes I am
> wondering if its now built in somehow?

No, there's no built-in multi-smtp setup in No Gnus/Emacs 24.1, but it's
certainly something that I want to add during the next development
cycle.

-- 
(domestic pets only, the antidote for overdose, milk.)
  bloggy blog http://lars.ingebrigtsen.no/

Re: smtpmail authentication again

[Kostas Zorbadelos]

Lars Magne Ingebrigtsen <larsi@gnus.org> writes:

> Richard Riley <rileyrg@gmail.com> writes:
>
>> There are numerous complex hacks/howtos out there which swap smtp
>> authinfo based on from address etc, but with all the recent changes I am
>> wondering if its now built in somehow?
>
> No, there's no built-in multi-smtp setup in No Gnus/Emacs 24.1, but it's
> certainly something that I want to add during the next development
> cycle.

I use msmtp [1] with posting styles to achieve this functionality and it
seems to work fine for me.

[1] http://msmtp.sourceforge.net

-- 
Kostas Zorbadelos		
twitter:@kzorbadelos		http://gr.linkedin.com/in/kzorba 
----------------------------------------------------------------------------
()  www.asciiribbon.org - against HTML e-mail & proprietary attachments
/\  

Re: smtpmail authentication again

[Richard Riley]

Kostas Zorbadelos <kzorba@otenet.gr> writes:

> Lars Magne Ingebrigtsen <larsi@gnus.org> writes:
>
>> Richard Riley <rileyrg@gmail.com> writes:
>>
>>> There are numerous complex hacks/howtos out there which swap smtp
>>> authinfo based on from address etc, but with all the recent changes I am
>>> wondering if its now built in somehow?
>>
>> No, there's no built-in multi-smtp setup in No Gnus/Emacs 24.1, but it's
>> certainly something that I want to add during the next development
>> cycle.
>
> I use msmtp [1] with posting styles to achieve this functionality and it
> seems to work fine for me.
>
> [1] http://msmtp.sourceforge.net

Msmtp is third party and doesnt allow, easily, encrypted authentication
: the passwords are stored in clear text meaning anyone who can access
your HD can read your passwords. Not good. unix file permissions are not
good enough IMO especially on a netbook , when not encrypted, which is
easily mislaid.

Re: smtpmail authentication again

[Leo]

On 2012-01-04 06:25 +0800, Lars Magne Ingebrigtsen wrote:
> No, there's no built-in multi-smtp setup in No Gnus/Emacs 24.1, but
> it's certainly something that I want to add during the next
> development cycle.

I think this is a good feature to have since lots of people want it and
lots of people have hacked their own solution.

Leo

Re: smtpmail authentication again

[Richard Riley]

Leo <sdl.web@gmail.com> writes:

> On 2012-01-04 06:25 +0800, Lars Magne Ingebrigtsen wrote:
>> No, there's no built-in multi-smtp setup in No Gnus/Emacs 24.1, but
>> it's certainly something that I want to add during the next
>> development cycle.
>
> I think this is a good feature to have since lots of people want it and
> lots of people have hacked their own solution.
>
> Leo

I woudl hazard a guess that just some optional parameters at the end of
the .authinfo would do it. for each account an outgoing smtp section
though I'm probably totally overly simplifying the work actually
involved. But certainly the ability to use .gpg files to store the smtp
auth info would be much aprpeciated. Many people use miltiple outgoing
smpt servers.

Re: smtpmail authentication again

[Ted Zlatanov]

On Tue, 03 Jan 2012 23:25:55 +0100 Lars Magne Ingebrigtsen <larsi@gnus.org> wrote: 

LMI> Richard Riley <rileyrg@gmail.com> writes:
>> There are numerous complex hacks/howtos out there which swap smtp
>> authinfo based on from address etc, but with all the recent changes I am
>> wondering if its now built in somehow?

LMI> No, there's no built-in multi-smtp setup in No Gnus/Emacs 24.1, but it's
LMI> certainly something that I want to add during the next development
LMI> cycle.

I'd love to see that.

Ted

Re: smtpmail authentication again

[Ted Zlatanov]

On Fri, 06 Jan 2012 21:07:29 -0500 Ted Zlatanov <tzz@lifelogs.com> wrote: 

TZ> On Tue, 03 Jan 2012 23:25:55 +0100 Lars Magne Ingebrigtsen <larsi@gnus.org> wrote: 
LMI> Richard Riley <rileyrg@gmail.com> writes:
>>> There are numerous complex hacks/howtos out there which swap smtp
>>> authinfo based on from address etc, but with all the recent changes I am
>>> wondering if its now built in somehow?

LMI> No, there's no built-in multi-smtp setup in No Gnus/Emacs 24.1, but it's
LMI> certainly something that I want to add during the next development
LMI> cycle.

TZ> I'd love to see that.

Ideally it would be set by a group/topic parameter and also overridden
at will.  It would be a logical name, which retrieves the rest of the
info from auth-source (defaulting to the machine name, unless a logical
name is also specified).

So you'd have

machine X port smtp ...
machine Y port smtp login alpha nickname alphaY
machine Y port smtp login beta nickname betaY

and then setting the new group/topic parameter to "X" gives you the
first one, "Y" gives you alphaY because it matches first in the file,
"alphaY" and "betaY" give you the second and third lines respectively.

WDYT?

Ted

Re: smtpmail authentication again

[Lars Magne Ingebrigtsen]

Ted Zlatanov <tzz@lifelogs.com> writes:

> Ideally it would be set by a group/topic parameter and also overridden
> at will.  It would be a logical name, which retrieves the rest of the
> info from auth-source (defaulting to the machine name, unless a logical
> name is also specified).
>
> So you'd have
>
> machine X port smtp ...
> machine Y port smtp login alpha nickname alphaY
> machine Y port smtp login beta nickname betaY
>
> and then setting the new group/topic parameter to "X" gives you the
> first one, "Y" gives you alphaY because it matches first in the file,
> "alphaY" and "betaY" give you the second and third lines respectively.

I haven't thought a lot about it, but I think it would have to be more
... complicated.  :-)

That is, I think a common use case would be to make lots of things
change based on what identity you're using.

If you're answering work email, you want to have that special
lawyer-mandated signature, your work From address, and you have to use
your company's outgoing SMTP server.

If it's personal email, you have funny signature, and you post via
Gmail with your Gmail From address.

So I think the most natural fit here would be to just add some smtpmail
variables to the group/topic parameters.

I think.

-- 
(domestic pets only, the antidote for overdose, milk.)
  bloggy blog http://lars.ingebrigtsen.no/

Re: smtpmail authentication again

[Ted Zlatanov]

On Sat, 07 Jan 2012 03:28:01 +0100 Lars Magne Ingebrigtsen <larsi@gnus.org> wrote: 

LMI> Ted Zlatanov <tzz@lifelogs.com> writes:
>> Ideally it would be set by a group/topic parameter and also overridden
>> at will.  It would be a logical name, which retrieves the rest of the
>> info from auth-source (defaulting to the machine name, unless a logical
>> name is also specified).
>> 
>> So you'd have
>> 
>> machine X port smtp ...
>> machine Y port smtp login alpha nickname alphaY
>> machine Y port smtp login beta nickname betaY
>> 
>> and then setting the new group/topic parameter to "X" gives you the
>> first one, "Y" gives you alphaY because it matches first in the file,
>> "alphaY" and "betaY" give you the second and third lines respectively.

LMI> I haven't thought a lot about it, but I think it would have to be more
LMI> ... complicated.  :-)

LMI> That is, I think a common use case would be to make lots of things
LMI> change based on what identity you're using.

LMI> If you're answering work email, you want to have that special
LMI> lawyer-mandated signature, your work From address, and you have to use
LMI> your company's outgoing SMTP server.

LMI> If it's personal email, you have funny signature, and you post via
LMI> Gmail with your Gmail From address.

LMI> So I think the most natural fit here would be to just add some smtpmail
LMI> variables to the group/topic parameters.

LMI> I think.

I think we're agreeing.  But why make it complicated?  I'd like to keep
as much as possible of the connectivity parameters encapsulated by
auth-source, if that's OK with you.  What can't be done with authinfo
lines like the above and a single "smtp-server-name" nickname
group/topic parameter?

Ted

Re: smtpmail authentication again

[Lars Ingebrigtsen]

Ted Zlatanov <tzz@lifelogs.com> writes:

> I think we're agreeing.  But why make it complicated?  I'd like to keep
> as much as possible of the connectivity parameters encapsulated by
> auth-source, if that's OK with you.  What can't be done with authinfo
> lines like the above and a single "smtp-server-name" nickname
> group/topic parameter?

I think I'd prefer for the config to be explicit, and not depend on
what's in the authinfo file, which may or may not be for similar, but
different services.

-- 
(domestic pets only, the antidote for overdose, milk.)
  http://lars.ingebrigtsen.no  *  Sent from my Rome

Re: smtpmail authentication again

[Ted Zlatanov]

On Thu, 26 Jan 2012 19:58:58 +0100 Lars Ingebrigtsen <larsi@gnus.org> wrote: 

LI> Ted Zlatanov <tzz@lifelogs.com> writes:
>> I think we're agreeing.  But why make it complicated?  I'd like to keep
>> as much as possible of the connectivity parameters encapsulated by
>> auth-source, if that's OK with you.  What can't be done with authinfo
>> lines like the above and a single "smtp-server-name" nickname
>> group/topic parameter?

LI> I think I'd prefer for the config to be explicit, and not depend on
LI> what's in the authinfo file, which may or may not be for similar, but
LI> different services.

Maybe we can have it both ways?  If it's 'auth-source then it uses that
library to get the parameters?

Ted

Re: smtpmail authentication again

[Lars Ingebrigtsen]

Ted Zlatanov <tzz@lifelogs.com> writes:

> Maybe we can have it both ways?  If it's 'auth-source then it uses that
> library to get the parameters?

Thinking about it a bit more, I think you're right that we could get
parameters from auth-source without it being too confusing.  If, for
instance, we have some multi-smtp setup that would, say, send all
replies to messages you get from Gmail to smtp.gmail.com, then
multi-smtp could just query auth-source for the port (and user name and
password, of course).

If the user has several smtp.gmail.com entries, then the user will have
to specify further in the multi-smtp setup what user name to use, for
instance.

-- 
(domestic pets only, the antidote for overdose, milk.)
  http://lars.ingebrigtsen.no  *  Sent from my Rome

Re: smtpmail authentication again

[Ted Zlatanov]

On Fri, 27 Jan 2012 18:59:38 +0100 Lars Ingebrigtsen <larsi@gnus.org> wrote: 

LI> Ted Zlatanov <tzz@lifelogs.com> writes:
>> Maybe we can have it both ways?  If it's 'auth-source then it uses that
>> library to get the parameters?

LI> Thinking about it a bit more, I think you're right that we could get
LI> parameters from auth-source without it being too confusing.  If, for
LI> instance, we have some multi-smtp setup that would, say, send all
LI> replies to messages you get from Gmail to smtp.gmail.com, then
LI> multi-smtp could just query auth-source for the port (and user name and
LI> password, of course).

LI> If the user has several smtp.gmail.com entries, then the user will have
LI> to specify further in the multi-smtp setup what user name to use, for
LI> instance.

OK.  Do you want to put together a spec for how it would work?

Ted

Re: smtpmail authentication again

[Lars Ingebrigtsen]

Ted Zlatanov <tzz@lifelogs.com> writes:

> OK.  Do you want to put together a spec for how it would work?

It's more Extreme Programmish to just write the code!

-- 
(domestic pets only, the antidote for overdose, milk.)
  http://lars.ingebrigtsen.no  *  Sent from my Rome

Re: smtpmail authentication again

[Steinar Bang]

>>>>> Lars Ingebrigtsen <larsi@gnus.org>:

> It's more Extreme Programmish to just write the code!

Actually, if you're going that way, you should write the test first.

A well commented test can work well as a spec, btw.

Re: smtpmail authentication again

[Ted Zlatanov]

On Fri, 27 Jan 2012 19:25:40 +0100 Lars Ingebrigtsen <larsi@gnus.org> wrote: 

LI> Ted Zlatanov <tzz@lifelogs.com> writes:
>> OK.  Do you want to put together a spec for how it would work?

LI> It's more Extreme Programmish to just write the code!

Extreme Programmers would have done it already in Ruby and node.js,
using 4 XML XSLT transforms.  Slacker.

Ted

Re: smtpmail authentication again

[Johann 'Myrkraverk' Oskarsson]

Ted Zlatanov <tzz@lifelogs.com> writes:

> On Fri, 27 Jan 2012 19:25:40 +0100 Lars Ingebrigtsen <larsi@gnus.org>
> wrote:
>
> LI> Ted Zlatanov <tzz@lifelogs.com> writes:
>>> OK.  Do you want to put together a spec for how it would work?
>
> LI> It's more Extreme Programmish to just write the code!
>
> Extreme Programmers would have done it already in Ruby and node.js,
> using 4 XML XSLT transforms.  Slacker.

Is it not XP enough to just use msmtp?  I'm currently using it with a
hook to set the -a flag according to my From: line.


Johann

Re: smtpmail authentication again

[Ted Zlatanov]

On Wed, 01 Feb 2012 18:53:14 +0000 "Johann 'Myrkraverk' Oskarsson" <myrkraverk@gmx.com> wrote: 

J'O> Ted Zlatanov <tzz@lifelogs.com> writes:
>> On Fri, 27 Jan 2012 19:25:40 +0100 Lars Ingebrigtsen <larsi@gnus.org>
>> wrote:
>> 
LI> Ted Zlatanov <tzz@lifelogs.com> writes:
>>>> OK.  Do you want to put together a spec for how it would work?
>> 
LI> It's more Extreme Programmish to just write the code!
>> 
>> Extreme Programmers would have done it already in Ruby and node.js,
>> using 4 XML XSLT transforms.  Slacker.

JO> Is it not XP enough to just use msmtp?  I'm currently using it with a
JO> hook to set the -a flag according to my From: line.

Installing msmtp is not always an option (e.g. W32 or machines with no
administrator privileges), and it's not integrated with auth-source or
any other Gnus functionality.  So it's not ideal for many cases, though
it certainly works well.

Ted

Re: smtpmail authentication again

[Richard Riley]

Ted Zlatanov <tzz@lifelogs.com> writes:

> On Wed, 01 Feb 2012 18:53:14 +0000 "Johann 'Myrkraverk' Oskarsson" <myrkraverk@gmx.com> wrote: 
>
> J'O> Ted Zlatanov <tzz@lifelogs.com> writes:
>>> On Fri, 27 Jan 2012 19:25:40 +0100 Lars Ingebrigtsen <larsi@gnus.org>
>>> wrote:
>>> 
> LI> Ted Zlatanov <tzz@lifelogs.com> writes:
>>>>> OK.  Do you want to put together a spec for how it would work?
>>> 
> LI> It's more Extreme Programmish to just write the code!
>>> 
>>> Extreme Programmers would have done it already in Ruby and node.js,
>>> using 4 XML XSLT transforms.  Slacker.
>
> JO> Is it not XP enough to just use msmtp?  I'm currently using it with a
> JO> hook to set the -a flag according to my From: line.
>
> Installing msmtp is not always an option (e.g. W32 or machines with no
> administrator privileges), and it's not integrated with auth-source or
> any other Gnus functionality.  So it's not ideal for many cases, though
> it certainly works well.

seconded. Keeping all smtp passwords in auth gpg files along with other
autentication data would be a great bonus. msmtp uses plain text config
files.

Re: smtpmail authentication again

[Richard Riley]

Lars Magne Ingebrigtsen <larsi@gnus.org> writes:

> Ted Zlatanov <tzz@lifelogs.com> writes:
>
>> Ideally it would be set by a group/topic parameter and also overridden
>> at will.  It would be a logical name, which retrieves the rest of the
>> info from auth-source (defaulting to the machine name, unless a logical
>> name is also specified).
>>
>> So you'd have
>>
>> machine X port smtp ...
>> machine Y port smtp login alpha nickname alphaY
>> machine Y port smtp login beta nickname betaY
>>
>> and then setting the new group/topic parameter to "X" gives you the
>> first one, "Y" gives you alphaY because it matches first in the file,
>> "alphaY" and "betaY" give you the second and third lines respectively.
>
> I haven't thought a lot about it, but I think it would have to be more
> ... complicated.  :-)
>
> That is, I think a common use case would be to make lots of things
> change based on what identity you're using.
>
> If you're answering work email, you want to have that special
> lawyer-mandated signature, your work From address, and you have to use
> your company's outgoing SMTP server.
>
> If it's personal email, you have funny signature, and you post via
> Gmail with your Gmail From address.
>
> So I think the most natural fit here would be to just add some smtpmail
> variables to the group/topic parameters.
>
> I think.

So long as the passwords are encrypted in the authinfo.gpg....

Re: smtpmail authentication again

[Ted Zlatanov]

On Sat, 07 Jan 2012 06:33:11 +0100 Richard Riley <rileyrg@gmail.com> wrote: 

RR> So long as the passwords are encrypted in the authinfo.gpg....

.gpg files are always encrypted if EPA/EPG is enabled, so yes.

You can also encrypt individual passwords in an otherwise unencrypted
netrc/authinfo file with `auth-source-netrc-use-gpg-tokens'.  But they
are not usable with other tools then.

Ted

Re: smtpmail authentication again

[Richard Riley]

Ted Zlatanov <tzz@lifelogs.com> writes:

> On Sat, 07 Jan 2012 06:33:11 +0100 Richard Riley <rileyrg@gmail.com> wrote: 
>
> RR> So long as the passwords are encrypted in the authinfo.gpg....
>
> .gpg files are always encrypted if EPA/EPG is enabled, so yes.
>
> You can also encrypt individual passwords in an otherwise unencrypted
> netrc/authinfo file with `auth-source-netrc-use-gpg-tokens'.  But they
> are not usable with other tools then.

,----
| Documentation:
| Set this to tell auth-source when to create GPG password
| tokens in netrc files.  It's either an alist or `never'.
| Note that if EPA/EPG is not available, this should NOT be used.
`----

I dont understand the docstring. How does auth-source create passwords?

While on the subject, whats the best elisp example/snippet to get a
password from the authinfo based on only machine name or machine name
and user id so I can use this in other elisp apps (e.g use authinfo to
get my irc password from .authinfo.gpg).

Re: smtpmail authentication again

[Ted Zlatanov]

On Sat, 07 Jan 2012 15:45:54 +0100 Richard Riley <rileyrg@gmail.com> wrote: 

RR> Ted Zlatanov <tzz@lifelogs.com> writes:
>> On Sat, 07 Jan 2012 06:33:11 +0100 Richard Riley <rileyrg@gmail.com> wrote: 
>> 
RR> So long as the passwords are encrypted in the authinfo.gpg....
>> 
>> .gpg files are always encrypted if EPA/EPG is enabled, so yes.
>> 
>> You can also encrypt individual passwords in an otherwise unencrypted
>> netrc/authinfo file with `auth-source-netrc-use-gpg-tokens'.  But they
>> are not usable with other tools then.

RR> ,----
RR> | Documentation:
RR> | Set this to tell auth-source when to create GPG password
RR> | tokens in netrc files.  It's either an alist or `never'.
RR> | Note that if EPA/EPG is not available, this should NOT be used.
RR> `----

RR> I dont understand the docstring. How does auth-source create passwords?

`auth-source-search' can, in some cases, create a whole entry, including
a password.  If this is created in an unencrypted file, you can choose
to encrypt just the password.  Also there's a "plstore" auth-source
backend (in addition to the "netrc" default backend) which stores
passwords and other secrets safely in an otherwise unencrypted file.

RR> While on the subject, whats the best elisp example/snippet to get a
RR> password from the authinfo based on only machine name or machine name
RR> and user id so I can use this in other elisp apps (e.g use authinfo to
RR> get my irc password from .authinfo.gpg).

Which IRC client?  I had a ERC patch a while ago but Deniz Dogan (the
maintainer then IIRC) didn't have the time to work on it.  In any case,
I'd rather submit a patch to the IRC client so you don't have to do this
yourself.

To answer your question about how to search, and assuming you don't want
to auto-create entries:

(let* ((auth-info (car
                   (auth-source-search
                    :host "yourhost.com"
                    :user "yourusername"
                    :max 1
                    :require '(:user :secret)
                    :create nil)))
       (user (plist-get auth-info :user))
       (password (plist-get auth-info :secret)))
  (when (functionp password)
    (setq password (funcall password)))
  (list user password auth-info))

If this returns nil, you can repeat the search without the :user query,
so you'll get any "yourhost.com" entries.

Ted

Re: smtpmail authentication again

[Richard Riley]

Ted Zlatanov <tzz@lifelogs.com> writes:

> On Sat, 07 Jan 2012 15:45:54 +0100 Richard Riley <rileyrg@gmail.com> wrote: 
>
> RR> Ted Zlatanov <tzz@lifelogs.com> writes:
>>> On Sat, 07 Jan 2012 06:33:11 +0100 Richard Riley <rileyrg@gmail.com> wrote: 
>>> 
> RR> So long as the passwords are encrypted in the authinfo.gpg....
>>> 
>>> .gpg files are always encrypted if EPA/EPG is enabled, so yes.
>>> 
>>> You can also encrypt individual passwords in an otherwise unencrypted
>>> netrc/authinfo file with `auth-source-netrc-use-gpg-tokens'.  But they
>>> are not usable with other tools then.
>
> RR> ,----
> RR> | Documentation:
> RR> | Set this to tell auth-source when to create GPG password
> RR> | tokens in netrc files.  It's either an alist or `never'.
> RR> | Note that if EPA/EPG is not available, this should NOT be used.
> RR> `----
>
> RR> I dont understand the docstring. How does auth-source create passwords?
>
> `auth-source-search' can, in some cases, create a whole entry, including
> a password.  If this is created in an unencrypted file, you can choose
> to encrypt just the password.  Also there's a "plstore" auth-source
> backend (in addition to the "netrc" default backend) which stores
> passwords and other secrets safely in an otherwise unencrypted file.
>
> RR> While on the subject, whats the best elisp example/snippet to get a
> RR> password from the authinfo based on only machine name or machine name
> RR> and user id so I can use this in other elisp apps (e.g use authinfo to
> RR> get my irc password from .authinfo.gpg).
>
> Which IRC client?  I had a ERC patch a while ago but Deniz Dogan (the
> maintainer then IIRC) didn't have the time to work on it.  In any case,
> I'd rather submit a patch to the IRC client so you don't have to do this
> yourself.
>
> To answer your question about how to search, and assuming you don't want
> to auto-create entries:
>
> (let* ((auth-info (car
>                    (auth-source-search
>                     :host "yourhost.com"
>                     :user "yourusername"
>                     :max 1
>                     :require '(:user :secret)
>                     :create nil)))
>        (user (plist-get auth-info :user))
>        (password (plist-get auth-info :secret)))
>   (when (functionp password)
>     (setq password (funcall password)))
>   (list user password auth-info))
>
> If this returns nil, you can repeat the search without the :user query,
> so you'll get any "yourhost.com" entries.

Thanks ted. I'll try to use this then to store my erc credentials in gpg
file. Strikes me as the srt of thing that would greatly benefit from
little wrappers for the commone usage as simple as

getUserForHost("host");
getPassForHost("host");

regards

r.

Re: smtpmail authentication again

[Ted Zlatanov]

On Tue, 10 Jan 2012 03:34:43 +0100 Richard Riley <rileyrg@gmail.com> wrote: 

RR> Thanks ted. I'll try to use this then to store my erc credentials in gpg
RR> file. Strikes me as the srt of thing that would greatly benefit from
RR> little wrappers for the commone usage as simple as

RR> getUserForHost("host");
RR> getPassForHost("host");

(CamelCase?  Horror!)

That would hide the search API, especially that you can get multiple
answers and connection parameters for a query.  End users are not
supposed to use auth-source directly, and packages will almost always
want the complex search.

Also getPass or whatever it's called will expose the password, whereas
now it's wrapped in a lexical-let so you can't see it easily until
you're ready to use it.

I understand the benefit of simplicity, though.  Hmmm.  Besides ERC,
where would you use the simpler functions?

Ted

Re: smtpmail authentication again

[Ted Zlatanov]

On Tue, 10 Jan 2012 09:37:39 -0500 Ted Zlatanov <tzz@lifelogs.com> wrote: 

TZ> Also getPass or whatever it's called will expose the password, whereas
TZ> now it's wrapped in a lexical-let so you can't see it easily until
TZ> you're ready to use it.

TZ> I understand the benefit of simplicity, though.  Hmmm.  Besides ERC,
TZ> where would you use the simpler functions?

OK, I've added it, afetr thinking for a little bit.  It's not ideal but
should do the job for siple queries.  You call it like this:

(auth-source-user-and-password "hostname")

(auth-source-user-and-password "hostname" "username")

The return has three elements, 1) the user name, 2) the password, 3) the
entire auth-source entry so you can get any other interesting info.

Ted

Re: smtpmail authentication again

[Richard Riley]

Ted Zlatanov <tzz@lifelogs.com> writes:

> On Tue, 10 Jan 2012 09:37:39 -0500 Ted Zlatanov <tzz@lifelogs.com> wrote: 
>
> TZ> Also getPass or whatever it's called will expose the password, whereas
> TZ> now it's wrapped in a lexical-let so you can't see it easily until
> TZ> you're ready to use it.
>
> TZ> I understand the benefit of simplicity, though.  Hmmm.  Besides ERC,
> TZ> where would you use the simpler functions?
>
> OK, I've added it, afetr thinking for a little bit.  It's not ideal but
> should do the job for siple queries.  You call it like this:
>
> (auth-source-user-and-password "hostname")
>
> (auth-source-user-and-password "hostname" "username")
>

I pulled nognus from git but this function is not there. there is
an -or-password funtion 

(auth-source-user-or-password MODE HOST PORT &optional USERNAME
CREATE-MISSING)

but that takes different args. Can you confirm
which repo this new function  is in and sorry if Im wasting your time.

Re: smtpmail authentication again

[Ted Zlatanov]

On Wed, 11 Jan 2012 06:45:23 +0100 Richard Riley <rileyrg@gmail.com> wrote: 

RR> I pulled nognus from git but this function is not there. there is
RR> an -or-password funtion 

RR> (auth-source-user-or-password MODE HOST PORT &optional USERNAME
RR> CREATE-MISSING)

RR> but that takes different args. Can you confirm
RR> which repo this new function  is in and sorry if Im wasting your time.

It's in the Gnut Git repo.  You did something wrong.  Here's the
function, anyhow:

#+begin_src lisp
(defun auth-source-user-and-password (host &optional user)
  (let* ((auth-info (car
                     (if user
                         (auth-source-search
                          :host host
                          :user "yourusername"
                          :max 1
                          :require '(:user :secret)
                          :create nil)
                       (auth-source-search
                        :host host
                        :max 1
                        :require '(:user :secret)
                        :create nil))))
         (user (plist-get auth-info :user))
         (password (plist-get auth-info :secret)))
    (when (functionp password)
      (setq password (funcall password)))
    (list user password auth-info)))

#+end_src

The old `auth-source-user-or-password' is obsolete.  I named this one
slightly differently to liven things up a bit (think "who's on first?"
"user-or-password?" "no, user-AND-password" "AND is on second?" etc. :)

Ted

Re: smtpmail authentication again

[Richard Riley]

Ted Zlatanov <tzz@lifelogs.com> writes:

> On Wed, 11 Jan 2012 06:45:23 +0100 Richard Riley <rileyrg@gmail.com> wrote: 
>
> RR> I pulled nognus from git but this function is not there. there is
> RR> an -or-password funtion 
>
> RR> (auth-source-user-or-password MODE HOST PORT &optional USERNAME
> RR> CREATE-MISSING)
>
> RR> but that takes different args. Can you confirm
> RR> which repo this new function  is in and sorry if Im wasting your time.
>
> It's in the Gnut Git repo.  You did something wrong.  Here's the
> function, anyhow:
>
>
>
> #+begin_src lisp
> (defun auth-source-user-and-password (host &optional user)
>   (let* ((auth-info (car
>                      (if user
>                          (auth-source-search
>                           :host host
>                           :user "yourusername"
>                           :max 1
>                           :require '(:user :secret)
>                           :create nil)
>                        (auth-source-search
>                         :host host
>                         :max 1
>                         :require '(:user :secret)
>                         :create nil))))
>          (user (plist-get auth-info :user))
>          (password (plist-get auth-info :secret)))
>     (when (functionp password)
>       (setq password (funcall password)))
>     (list user password auth-info)))
>
> #+end_src
>
>
>
> The old `auth-source-user-or-password' is obsolete.  I named this one
> slightly differently to liven things up a bit (think "who's on first?"
> "user-or-password?" "no, user-AND-password" "AND is on second?" etc. :)
>
> Ted
>
>
>
>

Problem isolated but not properly fixed :  have some sort of nasty race
issue/ side affect from loading nognus using el-get. Not relying on
el-get to set the path and manually setting the path to my nognus
installation BEFORE allowing el-get to do its stuff solved the
issue. Cheers for the function, I think you see the value or use more
clearly now - certainly my hidden password files are now a thing of the
path and everything is in  the authinfo gpg file.

Re: smtpmail authentication again

[Eric S Fraga]

Ted Zlatanov <tzz@lifelogs.com> writes:

> OK, I've added it, afetr thinking for a little bit.  It's not ideal but
> should do the job for siple queries.  You call it like this:
>
> (auth-source-user-and-password "hostname")
>
> (auth-source-user-and-password "hostname" "username")

Thanks for this.  Very useful, for identi.ca in my case but I guess ERC
use/configuration would benefit as well.

-- 
: Eric S Fraga (GnuPG: 0xC89193D8FFFCF67D) in Emacs 24.0.92.1 + No Gnus v0.18

Re: smtpmail authentication again

[Richard Riley]

Ted Zlatanov <tzz@lifelogs.com> writes:

> On Tue, 10 Jan 2012 03:34:43 +0100 Richard Riley <rileyrg@gmail.com> wrote: 
>
> RR> Thanks ted. I'll try to use this then to store my erc credentials in gpg
> RR> file. Strikes me as the srt of thing that would greatly benefit from
> RR> little wrappers for the commone usage as simple as
>
> RR> getUserForHost("host");
> RR> getPassForHost("host");
>
> (CamelCase?  Horror!)
>
> That would hide the search API, especially that you can get multiple
> answers and connection parameters for a query.  End users are not

It doesnt hide anything. The serch "api" is still there. Personally I
wouldnt have a snowballs chance in hell of understanding the elisp you
posted above ;)

> supposed to use auth-source directly, and packages will almost always
> want the complex search.

I think thats a bit of a jump. I'm asking as I have a lot of passwords
for various things in a hidden, chmod'ed plain text file. And Im certain
many others do too. In a gpg file they are safe. If I lose my netbook...

>
> Also getPass or whatever it's called will expose the password, whereas
> now it's wrapped in a lexical-let so you can't see it easily until
> you're ready to use it.

If one uses the function one takes the chance. I suspect the great
majority of us dont worryy too mcuh about certain passwords for things
not overly critical being in the memory of our local machines at
home. And anyways, it depends on how we code the the stuff that uses
this getPass/getUser wrapper : lexical hiding can be applied there too.

>
> I understand the benefit of simplicity, though.  Hmmm.  Besides ERC,
> where would you use the simpler functions?

Absolutely everywhere I needed to access a uid & password that I dont want
stored in plain text : "machine" here doubles for "account". Off the top
of my head:

erc, twitter, mysql, mpd server, bitlbee, identica.

Im sure there are plenty more.