POP3

POP3 is the protocol used by desktop email clients to fetch mail from a server. Clients transmit mail to their server via SMTP, just like servers transmitting to other servers.

Installing POP3

The most popular POP3 daemon is qpopper (/usr/ports/mail/qpopper). This program has its roots in BSD, and has been supported by Eudora for some time now. You can install it from package or port.

Qpopper runs out of inetd. Both the port and package will display a message explaining how to edit /etc/inetd.conf to support it. The example is an adequate default; we'll fine−tune that configuration later.

Testing POP3

POP3 can work in both unencrypted and encrypted modes. It's difficult to test encrypted POP3 by hand, unless you can compute cryptographic transactions in your head on the fly. You can easily test unencrypted POP3, though, and testing qpopper can help you determine whether a problem exists on the server or on the client.

To begin, telnet to port 110 on the server.

...............................................................................................

# telnet magpire.AbsoluteBSD.com 110

Trying 192.168.1.222...

Connected to magpire.AbsoluteBSD.com.

Escape character is '^]'.

+OK Qpopper (version 4.0.3) at magpire.AbsoluteBSD.com starting.

<3915.992459999@magpire.AbsoluteBSD.com>

...............................................................................................

This is roughly what you should see when you connect.

Authenticate to POP3

Once you are connected by telnet, identify yourself to the POP3 server with the "user" command:

...............................................................................................

user mwlucas

+OK Password required for mwlucas.

...............................................................................................

Now, use the pass command to give your password. Your password will be displayed on the screen in clear text. Be sure nobody's looking over your shoulder while you do this!

...............................................................................................

pass YourPasswordHere

+OK mwlucas has 1 visible message (0 hidden) in 500 octets.

...............................................................................................

327

Viewing Mail

I have one message! That's odd; I don't receive mail on this particular system. To view that message, use the retr command and the message number.

...............................................................................................

retr 1

+OK 500 octets

Return−Path: <mlucas@gltg.com>

Delivered−To: mwlucas@magpire.AbsoluteBSD.com Received: from turtledawn (turtledawn [192.168.1.200])

by magpire.AbsoluteBSD.com (postfix) with SMTP id D51998041C

for <mwlucas@magpire.AbsoluteBSD.com>; Fri, 8 Jun 2001 14:48:59 −0400 (EDT) Message−Id: <20010608184859.D51998041C@magpire.AbsoluteBSD.com>

Date: Fri, 8 Jun 2001 14:48:59 −0400 (EDT) From: mlucas@AbsoluteBSD.com

To: undisclosed−recipients:; X−UIDL: $ld"!9>2"!P?)"!JlU"! test

...............................................................................................

Oh, right. I did this when I demonstrated testing mail servers.

With these tests, you can be sure that POP3 works. If your installation doesn't behave like this, you need to investigate further.

POP3 Logging

When you start qpopper with the −s option, it logs all activity to syslog, using the local0 facility and the notice priority (see Chapter 19). This defaults to putting the log in /var/log/messages, but you can arrange it any way you like.

POP3 Modes

You can use POP3 in three different ways: default, APOP, and SSL (pop3ssl).

Default POP3

We saw an example of default POP3 earlier. It works, but isn't very secure. Anyone with a packet sniffer can grab your username and password just as if she were looking over your shoulder. This is a common protocol in the Internet service provider world.

APOP

APOP provides secure authentication, but requires additional overhead. Both the client and the server compute a "shared secret" based on the password and various other bits of information, such as the current time. The client sends that shared secret to the server. If it matches what the server computed, access is granted.

This might be a good choice for your server: APOP is a little older than pop3ssl, and many clients

328

support it. While the authentication information is secure, the email itself isn't.

Pop3ssl

Pop3ssl is the newest version of the POP3 protocol, as well as funnels, the connection over SSL. This is the most secure type of POP3 service you can have today.

We'll consider each type of POP3 in turn. In order to use either APOP or pop3ssl, you need to have a basic POP3 setup anyway.

Qpopper Preconfiguration Questions

Before you configure qpopper, you need to settle two questions: What kind of users will you have and will you be using local mail readers?

User Types

If you're providing corporate mail services via qpopper, you are ultimately responsible for setting up the clients (or, at best, working with the people who have to set up the clients). You can insist upon things like "All users must type their usernames in lowercase" and "Mail must remain on the server." You can also insist that they use APOP or pop3ssl instead of default POP3.

If you're providing services for hundreds or thousands of people, you need a configuration that allows more user mistakes and handles a wider variety of email clients. You won't keep your users long if you insist that they use one of your approved email readers instead of the mail program that they've used for years!

Local Mail Readers

ome users read email locally on the server, using a UNIX−based email client, such as mutt(1) or pine(1). These clients change the users' mail file directly on the server.

If qpopper can safely assume that the mail spool will not change out from underneath it, it can make several optimizations that will greatly improve performance. This isn't a big deal for systems administrators—many sysadmins don't use POP3, relying instead on ssh and a local mail reader. Some power users might want to use both, however. If you don't allow the combination of local mail readers and POP3, you can optimize qpopper.

Default Qpopper Configuration

A raw install of qpopper will give you basic POP3 functionality, as demonstrated earlier. Users will be able to connect and download their mail. You can do various things to improve performance, however, and you can enhance your setup rather easily.

Earlier versions of qpopper were configured entirely by options on the command line in /etc/inetd.conf. This worked well when qpopper was a simple program that only supported default POP3. As APOP and pop3ssl became more common, however, command−line configuration became less and less practical. Once the command−line arguments start to wrap around the screen two or three times, you really need to convert your program to use a configuration file.

While a vanilla POP3 qpopper install doesn't need a config file, we're going to use one.

329

Config Files and Inetd

The obvious place on a FreeBSD system to put the qpopper configuration file is under /usr/local/etc/qpopper. By default, only root can access the qpopper directory. More advanced qpopper implementations will also store user databases and security certificates in this directory.

To tell qpopper to take its settings from a file in this directory, use the −f flag. You can make all your other changes in the configuration file, and never have to touch /etc/inetd.conf again. This would make your inetd.conf entry look like this (and despite the page width, this is all on one line):

...............................................................................................

pop3 stream tcp nowait root /usr/local/libexec/qpopper qpopper −s −f

/usr/local/etc/qpopper/qpopper.conf

...............................................................................................

Qpopper.conf

Now that you've told your system how to run qpopper, you need to create the configuration file. Each configuration statement in qpopper.conf appears on its own line, preceded by the word set. Any of these options can be combined with APOP and pop3ssl.

Qpopper Mode

The most important option you have is how qpopper is going to work. The following setting controls whether qpopper will accept clear−text passwords, as used in the manual test earlier.

...............................................................................................

set clear−text−password = default

...............................................................................................

You have a few different options here. We're going to look at the most common.

By default, qpopper checks to see if the user is set up for APOP. If so, then clear−text passwords are not allowed. If the user is not set up for APOP, then clear−text passwords are permitted. Use this for standard services.

Specifying always as the setting means that qpopper will accept clear−text passwords, even if the user is set up for APOP. You might need to use this in an ISP environment; while you'd like the user to use APOP, some users have email clients that simply cannot handle it.

Specifying never means that clear−text passwords will not work, even if you're using pop3ssl. You must use APOP to get your mail.

Specifying tls means that clear−text passwords are acceptable if you're running over an encrypted connection (such as SSL). After all, the entire connection is encrypted!

We'll discuss APOP and POP3 over SSL later (in "APOP Setup" and "Configuring Pop3ssl," respectively.)

330

Username Case

If you have a variety of users, some of them will type their username in all capital letters. That's how usernames appear in the movies, after all! By putting the following line in your configuration, usernames received from clients are transformed into all lowercase before qpopper attempts to authenticate them.

...............................................................................................

set downcase−user = true

...............................................................................................

This can reduce your technical support calls.

Mail Spool Handling

A POP3 client can choose to either copy all messages from the server, download and delete all messages from the server, or delete some messages from the server while leaving the rest. The first two choices (leave everything and delete everything) are typical of core mail−server functionality. The third, a mix of saving and deleting, is a lot of work, and it is set with the following line:

...............................................................................................

set server−mode = false

...............................................................................................

Server mode assumes that the client will either save all its mail or delete all its mail. This makes qpopper much faster, and reduces server disk I/O. If you enable server mode, you greatly increase qpopper's efficiency.

You also make some promises to qpopper when you enable server mode, however. Qpopper will assume that mail is only delivered to clients by qpopper. This is where the "mixing local mail readers and POP3" problem appears. If you use a local mail reader to check mail on an account, and someone pops that account's mail while you're reading it, you can damage users' mail. You don't want to do that. If you don't combine POP3 and local mail clients, and don't read your users' mail, setting this to true is perfectly safe and will improve performance.

Reducing Disk Activity

If you set the following option, you will decrease your disk activity by a third:

...............................................................................................

set fast−update = false

...............................................................................................

This setting doesn't mix with local mail readers, however. You will also break UNIX programs that notify you of new mail on the UNIX system. This is perfectly safe on a POP−only mail server.

331