Current git HEAD nnimap doesn't do cram-md5 auth

Current git HEAD nnimap doesn't do cram-md5 auth

[Steinar Bang]

I just noticed today that Gnus nnimap only did PLAIN authentication
against dovecot.  When I disabled PLAIN completely on the dovecot, it
said:
 Warning: Opening nnimap server on privat...failed: NO (ALERT) Unsupported authentication mechanism.

Is this because the CAPABILITY lacks on dovecot? (how do I run
nnimap-capabilities interactively? I couldn't even find where it's
defined... `C-h f' sayis it is nnimap.el, but neither TAGS, nor grep,
nor occur can find where it is defined...)

Or is it some setting missing from my nnimap settings?

Here's my select method (anonymized to protect the innocent):
        (nnimap "privat"
		(nnimap-address "imap.mydomain.no")
                (nnimap-stream ssl))

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Andreas Schwab]

Steinar Bang <sb@dod.no> writes:

> (how do I run nnimap-capabilities interactively?

Try ielm.

> I couldn't even find where it's defined... `C-h f' sayis it is
> nnimap.el, but neither TAGS, nor grep, nor occur can find where it is
> defined...)

(defstruct nnimap
  group process commands capabilities select-result newlinep server
  last-command-time greeting examined)

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Steinar Bang]

>>>>> Andreas Schwab <schwab@linux-m68k.org>:

> Steinar Bang <sb@dod.no> writes:
>> (how do I run nnimap-capabilities interactively?

> Try ielm.

The problem is what to give it as argument (an nnimap-object), not
actualy running it.

I thought I had run it from *scratch* at one point in time, but I was
unable to find it.

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Lars Magne Ingebrigtsen]

Steinar Bang <sb@dod.no> writes:

> I thought I had run it from *scratch* at one point in time, but I was
> unable to find it.

nnimap-object is local to each nnimap buffer, so you have to eval it
there. 

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Steinar Bang]

>>>>> Steinar Bang <sb@dod.no>:

> I just noticed today that Gnus nnimap only did PLAIN authentication
> against dovecot.  When I disabled PLAIN completely on the dovecot, it
> said:
>  Warning: Opening nnimap server on privat...failed: NO (ALERT) Unsupported authentication mechanism.

I haven't found out what dovecot lists as capabilities, but here's what
it says in the log on the connect after I disabled PLAIN auth
(anonymized IP numbers):
 Jan  1 14:31:39 myhost dovecot: imap-login: Disconnected (tried to use unsupported auth mechanism): method=PLAIN, rip=192.168.226.192, lip=192.168.185.190, TLS: Disconnected

So it kind of looks like Gnus never tries anything other than PLAIN...?

I use ~/.authinfo to get usernames and passwords.

Line-wrap on by default: how do I turn it off? (Was: Current git HEAD nnimap doesn't do cram-md5 auth)

[Steinar Bang]

Hm... a long log line I sent looks like this when I read it back:
 Jan 1 14:31:39 myhost dovecot: imap-login: Disconnected (tried to use
unsupported auth mechanism): method=PLAIN, rip=192.168.226.192,
lip=192.168.185.190, TLS: Disconnected

`C-u g' reveals that the line is actually unbroken in the raw message.
So that means that `W u', or something like that, is in effect by
default.

How do I turn it off?  If I wanted it on by default, it would have been
there years ago.

Re: Line-wrap on by default: how do I turn it off? (Was: Current git HEAD nnimap doesn't do cram-md5 auth)

[Andreas Schwab]

Steinar Bang <sb@dod.no> writes:

> How do I turn it off?

gnus-treat-fill-long-lines

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: Line-wrap on by default: how do I turn it off?

[Steinar Bang]

The behaviour seems to have been turned on by this change:

commit f2d0a4889766f0387f6423f52502ea4842f83846
Author: Lars Magne Ingebrigtsen <larsi@quimbies.gnus.org>
Date:   Sun Oct 31 22:06:08 2010 +0100

    Change default to all text/plain sections.

And the diff on the line in question, is:
--- a/lisp/gnus-art.el
+++ b/lisp/gnus-art.el
@@ -1590,7 +1590,7 @@ predicate.  See Info node `(gnus)Customizing Articles'."
   :link '(custom-manual "(gnus)Customizing Articles")
   :type gnus-article-treat-custom)
 
-(defcustom gnus-treat-fill-long-lines nil
+(defcustom gnus-treat-fill-long-lines '(typep "text/plain")
   "Fill long lines.
 Valid values are nil, t, `head', `first', `last', an integer or a
 predicate.  See Info node `(gnus)Customizing Articles'."

So, a customize back to nil, should do the trick.  I will try.

Re: Line-wrap on by default: how do I turn it off?

[Steinar Bang]

>>>>> Steinar Bang <sb@dod.no>:

> The behaviour seems to have been turned on by this change:
... 
> -(defcustom gnus-treat-fill-long-lines nil
> +(defcustom gnus-treat-fill-long-lines '(typep "text/plain")
...
> So, a customize back to nil, should do the trick.  I will try.

Yep.  A customize of gnus-treat-fill-long-lines to nil made the long
lines show up again.

Re: Line-wrap on by default: how do I turn it off?

[Reiner Steib]

On Sat, Jan 01 2011, Steinar Bang wrote:

> Author: Lars Magne Ingebrigtsen <larsi@quimbies.gnus.org>
> Date:   Sun Oct 31 22:06:08 2010 +0100
>
>     Change default to all text/plain sections.
>
> And the diff on the line in question, is:
> --- a/lisp/gnus-art.el
> +++ b/lisp/gnus-art.el
> @@ -1590,7 +1590,7 @@ predicate.  See Info node `(gnus)Customizing Articles'."
>    :link '(custom-manual "(gnus)Customizing Articles")
>    :type gnus-article-treat-custom)
>
> -(defcustom gnus-treat-fill-long-lines nil
> +(defcustom gnus-treat-fill-long-lines '(typep "text/plain")
>    "Fill long lines.

There should be a :version tag there.

Bye, Reiner.
-- 
       ,,,
      (o o)
---ooO-(_)-Ooo---  |  PGP key available  |  http://rsteib.home.pages.de/

Re: Line-wrap on by default: how do I turn it off?

[Steinar Bang]

>>>>> Reiner Steib <reinersteib+gmane@imap.cc>:

> There should be a :version tag there.

Er... huh...?

Version tags for customizable variables (was: Line-wrap on by default: how do I turn it off?)

[Reiner Steib]

On Mon, Jan 03 2011, Steinar Bang wrote:

>>>>>> Reiner Steib <reinersteib+gmane@imap.cc>:
>
>> There should be a :version tag there.
>
> Er... huh...?

When the default value of a variable is changed (or a new customizable
variable is added) there should be a tag like ...

  :version "24.1"
 
See ...

,----[ <f1> f customize-changed RET ]
| customize-changed is an alias for `customize-changed-options' in
| `cus-edit.el'.
| (customize-changed SINCE-VERSION)
| 
| Customize all settings whose meanings have changed in Emacs itself.
| This includes new user option variables and faces, and new
| customization groups, as well as older options and faces whose meanings
| or default values have changed since the previous major Emacs release.
| 
| With argument SINCE-VERSION (a string), customize all settings
| that were added or redefined since that version.
`----

Bye, Reiner.
-- 
       ,,,
      (o o)
---ooO-(_)-Ooo---  |  PGP key available  |  http://rsteib.home.pages.de/

Re: Version tags for customizable variables

[Steinar Bang]

>>>>> Reiner Steib <reinersteib+gmane@imap.cc>:

> When the default value of a variable is changed (or a new customizable
> variable is added) there should be a tag like ...

I wasn't offering up a diff.  I was just digging up the change that had
changed the old behaviour.

Re: Version tags for customizable variables

[Reiner Steib]

On Mon, Jan 03 2011, Steinar Bang wrote:

> I wasn't offering up a diff.  I was just digging up the change that had
> changed the old behaviour.

Sure.  I didn't expect _you_ to fix it.  Why I sent it to the list.

Bye, Reiner.
-- 
       ,,,
      (o o)
---ooO-(_)-Ooo---  |  PGP key available  |  http://rsteib.home.pages.de/

Re: Line-wrap on by default: how do I turn it off?

[Lars Magne Ingebrigtsen]

Reiner Steib <reinersteib+gmane@imap.cc> writes:

> There should be a :version tag there.

Fixed now.

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Lars Magne Ingebrigtsen]

Steinar Bang <sb@dod.no> writes:

> I just noticed today that Gnus nnimap only did PLAIN authentication
> against dovecot. 

Yes.  Instead of implementing all of the gazillion different auth
methods, I was just waiting for people to complain, and then implement
them.  So far, out of all the different methods, people have only
requested AUTH=PLAIN, so I think it's a winning strategy.  :-)

So you have a server that actually only does cram-md5?

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Steinar Bang]

>>>>> Lars Magne Ingebrigtsen <larsi@gnus.org>:

> So you have a server that actually only does cram-md5?

Indeed I do.  Always have, since I first set up an IMAP server of my
own.

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Lars Magne Ingebrigtsen]

Steinar Bang <sb@dod.no> writes:

>> So you have a server that actually only does cram-md5?
>
> Indeed I do.  Always have, since I first set up an IMAP server of my
> own.

Ok, I'll implement the cram-md5 stuff, then.

But what's the point of cram-md5, though?

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Steinar Bang]

>>>>> Lars Magne Ingebrigtsen <larsi@gnus.org>:

> But what's the point of cram-md5, though?

Login authentication without sending the actual clear text password over
the wire.

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Lars Magne Ingebrigtsen]

Steinar Bang <sb@dod.no> writes:

> Login authentication without sending the actual clear text password over
> the wire.

Doesn't everybody just use TLS/STARTTLS?

Anyway, it's implemented now.

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Ted Zlatanov]

On Sun, 02 Jan 2011 22:41:10 +0100 Lars Magne Ingebrigtsen <larsi@gnus.org> wrote: 

LMI> Steinar Bang <sb@dod.no> writes:
>> Login authentication without sending the actual clear text password over
>> the wire.

LMI> Doesn't everybody just use TLS/STARTTLS?

I think CRAM-MD5 predated such fancies.

Ted

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Steinar Bang]

>>>>> Lars Magne Ingebrigtsen <larsi@gnus.org> said on Sun, 02 Jan 2011:

[About cram-md5 auth for nnimap]

> Doesn't everybody just use TLS/STARTTLS?

> Anyway, it's implemented now.

And this worked well for 23 days...

Unfortunately on January 25 2011, this commit came and broke it...:-/

commit f842d586ed445171f1efac765755f17ae9f94d19
Author: Lars Magne Ingebrigtsen <larsi@gnus.org>
Date:   Tue Jan 25 13:58:22 2011 -0800

    Prefer plain LOGIN if it's enabled and we're using an encrypted connection.

But I prefer CRAM-MD5 always, whether the connection is encrypted or
not.

However, if I disable PLAIN, then the iPad mail client (not my iPad)
isn't able to connect...:-(

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Steinar Bang]

>>>>> Steinar Bang <sb@dod.no>:

> But I prefer CRAM-MD5 always, whether the connection is encrypted or
> not.

> However, if I disable PLAIN, then the iPad mail client (not my iPad)
> isn't able to connect...:-(

Anyway... removing PLAIN from dovecot didn't make nnimap switch to
CRAM-MD5:
 Sep 13 20:46:38 myhost dovecot: imap-login: Disconnected (tried to use unsupported auth mechanism): method=PLAIN, rip=<removed>, lip=<removed>, TLS: Disconnected

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Steinar Bang]

>>>>> Steinar Bang <sb@dod.no>:

> Anyway... removing PLAIN from dovecot didn't make nnimap switch to
> CRAM-MD5:
>  Sep 13 20:46:38 myhost dovecot: imap-login: Disconnected (tried to use unsupported auth mechanism): method=PLAIN, rip=<removed>, lip=<removed>, TLS: Disconnected

Reverting commit f842d586ed445171f1efac765755f17ae9f94d19 made CRAM-MD5
work again.

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Steinar Bang]

>>>>> Steinar Bang <sb@dod.no>:
>>>>> Steinar Bang <sb@dod.no>:

>> Anyway... removing PLAIN from dovecot didn't make nnimap switch to
>> CRAM-MD5:
>> Sep 13 20:46:38 myhost dovecot: imap-login: Disconnected (tried to use unsupported auth mechanism): method=PLAIN, rip=<removed>, lip=<removed>, TLS: Disconnected

> Reverting commit f842d586ed445171f1efac765755f17ae9f94d19 made CRAM-MD5
> work again.

And I can also keep PLAIN enabled so that the iPad will work, while Gnus
now uses CRAM-MD5.

On a side note, I just found out that iPad2 with iOS 4 have no NTP
option (I noticed that the clock on the iPad was off).  Quite amazing
really....

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Lars Ingebrigtsen]

Steinar Bang <sb@dod.no> writes:

>     Prefer plain LOGIN if it's enabled and we're using an encrypted
>     connection.
>
> But I prefer CRAM-MD5 always, whether the connection is encrypted or
> not.

What's the advantage of CRAM-MD5 over PLAIN over encrypted connections?

-- 
(domestic pets only, the antidote for overdose, milk.)
  http://lars.ingebrigtsen.no  *  Lars Magne Ingebrigtsen

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Steinar Bang]

>>>>> Lars Ingebrigtsen <larsi@gnus.org>:

> What's the advantage of CRAM-MD5 over PLAIN over encrypted connections?

It's an extra layer of safety.

Even if the encryption is broken, the password isn't revealed.  What you
see is useless for replay attacks.

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Lars Ingebrigtsen]

Steinar Bang <sb@dod.no> writes:

>> What's the advantage of CRAM-MD5 over PLAIN over encrypted connections?
>
> It's an extra layer of safety.
>
> Even if the encryption is broken, the password isn't revealed.  What you
> see is useless for replay attacks.

Right.

I've now expanded `nnimap-authentication' to allow specifying the login
method to be used.

-- 
(domestic pets only, the antidote for overdose, milk.)
  http://lars.ingebrigtsen.no  *  Lars Magne Ingebrigtsen

Re: Current git HEAD nnimap doesn't do cram-md5 auth

[Steinar Bang]

>>>>> Lars Ingebrigtsen <larsi@gnus.org>:

> I've now expanded `nnimap-authentication' to allow specifying the login
> method to be used.

I've verified that it works.

Thanks!