[lug] fetchmail

[D. Stimits]

John Hernandez wrote:
> 
> "D. Stimits" wrote:
> >
> > "D. Stimits" wrote:
> > >
> > > I'm going to install fetchmail to download but not delete messages, as a
> > > general backup mechanism (since NS has hosed my mail twice in the last
> > > month or so) on two machines. The rpm files I downloaded do not contain
> > > an rc.d/init.d style script, and I am wondering how many people here
> > > with RH start their fetchmail with such a script? If you do not want to
> > > poll for mail, but only download when you specifically want to, do you
> > > just run a command line for fetchmail to retrieve once? Do you run
> > > fetchmail as root (which seems to imply fetchmail will change its euid
> > > to the particular user it downloads as)?
> > >
> > > D. Stimits, stimits at idcomm.com
> >
> > Ouch! I just found something I really don't like about fetchmail. If you
> > save the pass, it puts it in plain text in .fetchmailrc. Root is the
> > only user that has any hope of hiding the pass, and I still dislike
> > plain text passes since root can make mistakes or get root kit'd. Is
> > there a better (more secure) email retrieval system out there?
> >
> > D. Stimits, stimits at idcomm.com
> > _______________________________________________
> > Web Page:  http://lug.boulder.co.us
> > Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> 
> I can't think of a system that would offer any protection in the event that your machine gets root'ed.  At that point, your remote POP3 password is probably just one of many larger concerns.

All of which is true of course. I guess I would like to be able to
encrypt the pass with something better than xor, but not necessarily
strong encryption (script kiddies don't usually know how to decrypt
without a script for the particular scenario). A one-way hash is not
what I am thinking of. Then compile the decrypt pass into the app that
reads it, but do it in a way similar to steganography, spread it out
such that it is hard to find even with a hex editor. wvdial has a
similar problem, but only root runs wvdial anyway (or at least only root
has access to /etc/wvdial.conf, or else it argues about
running...fetchmail does not argue). What would be interesting is a
system that changes something each time root (or any user authorized to
fetch) logs in...a mutating key (not easy to do).

D. Stimits, stimits at idcomm.com

> 
> In order to automate a procedure that requires a password, it will need to be stored somewhere.  Maybe you can set up a trust using PKI and ssh.  There again, a stolen key will compromise your system.  If security is a high enough priority, you can probably devise some method of POP'ing manually immediately before running NS.  But if convenience is high on your wish list, security will probably suffer a bit.
> 
> --
> 
>   - John Hernandez - Network Engineer - 303-497-6392 -
>  |  National Oceanic and Atmospheric Administration   |
>  |  Mailstop R/OM12. 325 Broadway, Boulder, CO 80305  |
>   ----------------------------------------------------
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug