Nabble - squirrelmail-users

Stupid users and 10K INBOX

2009-11-12T00:21:03Z

Ok, so I get a call from this user complaining that SM is taking many
many minutes to load, and sometimes timing out.

So I log in to SM on my account and it's snappy. Very snappy, even.

So, knowing this user is a technomoron I check his account. He has
12,844 emails in his INBOX.

Keeping in mind I've told him several times not to do that, is there
anything I can do? Is there a way to tell SM to only look at the last
1,000 emails or something?

If SM was just getting a count of mesages, it should be pretty fast.
ls -1 | wc -l only takes a second, so what else is SM doing when it
loads the inbox? Scanning every mail's headers?

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

International characters don't display correctly in the from field

2009-11-11T23:24:10Z

Hi. I'm having problems with international characters in the from field
in the message list in SquirrelMail 1.4.19. Instead of the actual
characters
I see eg. =?iso-8859-1?q?=C5slund_Tr=F6ger=22?= (quoted printable?). See
http://welzien.se/misc/squirrelmail.png for an example. For some reason
the characters look good in the subject field.

When I open the email, the from field display correctly though.

The from field in the email header looks like this:
From: =?iso-8859-1?Q?Rikard_=C5slund_Tr=F6ger?= <xxxxxxxxx@...>

The problem only occurs in the from field in the message list view.

The characters display correctly when using RoundCube. I haven't tried
any other mail reader.

System:

Gentoo
SquirrelMail 1.4.19
Apache 2.2.10
PHP 5.2.8-r2
DBMail 2.2.11_rc3-r1
Fetchmail 6.3.9

All software installed using portage ebuilds.

Installed plugins:
add_address
calendar
message_details
view_as_html
notes

--
/Peter Welzien

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Preferences or plugins not applied correctly

2009-11-10T00:02:30Z

ansley-2 wrote:

_ My preferences are stored in a Mysql DB
1) I can see my prefenrences in the related table
2) When I change some preferences value, I logout and login again the new values i've chosen remain

Could you show SQL dump with structure of your preference table?

Which privileges are granted to database user set in SquirrelMail configuration and which DB user are you using to edit preferences?

--
Tomas

Re: Preferences or plugins not applied correctly

2009-11-09T20:01:07Z

Please do not top-post. Please READ the mailing list posting guidelines.

>> > When users login some plugins does not load correctly (such selct_range
>> > and
>> > html_mail). For select_range , no link is added in the message list; for
>> > html_mail ,no editor is loaded in the compose page.I have to go to the
>> > display preferences page and only click the save button to have theses
>> > plugins to work as expected.And at the next login , although the
>> > parameters
>> > related to these plugins are presents whith the settings I've defined
>> > in
>> > the display preferences page, I must click before the save button to
>> > have
>> > thes to work.
>>
>> Please debug ONE plugin at a time.
>> Envoyer
>> Disable ALL plugins except the one you have problems with.
>>
>> Then if the problem persists, show what the difference is between the
>> user's preferences when the plugin is working and what they are when
>> you log in next and it's not working. Are you certain your
>> preferences are saving correctly?
>>
>> Have you tested with error reporting turned up all the way? Do you
>> see PHP errors?
>
> I've tried your recommendations.But I 've no result
> - I've disabled all plugins except select_range and html_mail
> The result is the same

No, you need to disable all except ONE of them at a time.

> _ I've thrned Error reporting on
> But no error is reported

Show your configtest results.

> _ My preferences are stored in a Mysql DB
> 1) I can see my prefenrences in the related table
> 2) When I change some preferences value, I logout and login again the new
> values i've chosen remain

So it sounds like preferences are stored correctly. Then I don't see
what your problem is.

> There is no difference in the preferences values displayed when the plugin
> is working and when it is not.

Sounds suspicious to me. SOMETHING has to be different between when
it works and when it doesn't, and it's your job to tell us what that
is.

>> > Thanks in advance for you help and sorry for my poor english
>> >
>> > Best Regards
>> >
>> > Ansley
>> >
>> >
>> > squirrelmail 1.4.19
>> >
>> > plugins enabled
>> > $plugins[0] = 'compatibility';
>> > $plugins[1] = 'secure_login';
>> > $plugins[2] = 'download_all';
>> > $plugins[3] = 'email_footer';
>> > $plugins[4] = 'extract';
>> > $plugins[5] = 'folder_sizes';
>> > $plugins[6] = 'folder_synch';
>> > $plugins[7] = 'html_mail';
>> > $plugins[8] = 'msg_flags';
>> > $plugins[9] = 'quicksave';
>> > $plugins[10] = 'reply_buttons';
>> > $plugins[11] = 'delete_move_next';
>> > $plugins[12] = 'select_range';
>> > $plugins[13] = 'view_as_html';
>> > $plugins[14] = 'addgraphics';
>> > $plugins[15] = 'abook_import_export';
>> > $plugins[16] = 'admin_add';
>> > $plugins[17] = 'administrator';
>> > $plugins[18] = 'archive_mail';
>> > $plugins[19] = 'change_pass';
>> > $plugins[20] = 'calendar';
>> > $plugins[21] = 'attachment_doc';
>> > $plugins[22] = 'add_address';
>> > $plugins[23] = 'cleanup';
>> >
>> > OS RedHat Linux 2.6.18-8.1.8.el5

--
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Preferences or plugins not applied correctly

2009-11-09T13:01:11Z

Thanks Paul for your response.

I've tried your recommendations.But I 've no result
- I've disabled all plugins except select_range and html_mail
   The result is the same

_ I've thrned Error reporting on
   But no error is reported

_ My preferences are stored in a Mysql DB
   1) I can see my prefenrences in the related table
   2) When I change some preferences value, I logout and login again the new values i've chosen remain

There is no difference in the preferences values displayed when the plugin is working and when it is not.

Ansley Jean-Louis

> Date: Fri, 6 Nov 2009 17:56:01 -0800
> From: paul@...
> To: squirrelmail-users@...
> Subject: Re: [SM-USERS] Preferences or plugins not applied correctly
>
> On Fri, Nov 6, 2009 at 12:23 PM, Ansley Jean Louis <jansley@...> wrote:
> > When users login some plugins does not load correctly (such selct_range and
> > html_mail). For select_range , no link is added in the message list; for
> > html_mail ,no editor is loaded in the compose page.I have to go to the
> > display preferences page and only click the save button to have theses
> > plugins to work as expected.And at the next login , although the parameters
> > related to these plugins are presents whith the settings I've defined in
> > the display preferences page, I must click before the save button to have
> > thes to work.
>
> Please debug ONE plugin at a time.
> Envoyer
> Disable ALL plugins except the one you have problems with.
>
> Then if the problem persists, show what the difference is between the
> user's preferences when the plugin is working and what they are when
> you log in next and it's not working. Are you certain your
> preferences are saving correctly?
>
> Have you tested with error reporting turned up all the way? Do you
> see PHP errors?
>
> > Thanks in advance for you help and sorry for my poor english
> >
> > Best Regards
> >
> > Ansley
> >
> >
> > squirrelmail 1.4.19
> >
> > plugins enabled
> > $plugins[0] = 'compatibility';
> > $plugins[1] = 'secure_login';
> > $plugins[2] = 'download_all';
> > $plugins[3] = 'email_footer';
> > $plugins[4] = 'extract';
> > $plugins[5] = 'folder_sizes';
> > $plugins[6] = 'folder_synch';
> > $plugins[7] = 'html_mail';
> > $plugins[8] = 'msg_flags';
> > $plugins[9] = 'quicksave';
> > $plugins[10] = 'reply_buttons';
> > $plugins[11] = 'delete_move_next';
> > $plugins[12] = 'select_range';
> > $plugins[13] = 'view_as_html';
> > $plugins[14] = 'addgraphics';
> > $plugins[15] = 'abook_import_export';
> > $plugins[16] = 'admin_add';
> > $plugins[17] = 'administrator';
> > $plugins[18] = 'archive_mail';
> > $plugins[19] = 'change_pass';
> > $plugins[20] = 'calendar';
> > $plugins[21] = 'attachment_doc';
> > $plugins[22] = 'add_address';
> > $plugins[23] = 'cleanup';
> >
> > OS RedHat Linux 2.6.18-8.1.8.el5
>
> --
> Paul Lesniewski
> SquirrelMail Team
> Please support Open Source Software by donating to SquirrelMail!
> http://squirrelmail.org/donate_paul_lesniewski.php
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now. http://p.sf.net/sfu/bobj-july
> -----
> squirrelmail-users mailing list
> Posting guidelines: http://squirrelmail.org/postingguidelines
> List address: squirrelmail-users@...
> List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
> List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Un avatar à votre image ? Créez votre mini-moi !
------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Preferences or plugins not applied correctly

2009-11-06T17:56:01Z

On Fri, Nov 6, 2009 at 12:23 PM, Ansley Jean Louis <jansley@...> wrote:
> When users login some plugins does not load correctly (such selct_range and
> html_mail). For select_range , no link is added in the message list; for
> html_mail ,no editor is loaded in the compose page.I have to go to the
> display preferences page and only click the save button to have theses
> plugins to work as expected.And at the next login , although the parameters
> related to these plugins are presents whith the settings I've defined in
> the display preferences page, I must click before the save button to have
> thes to work.

Please debug ONE plugin at a time.

Disable ALL plugins except the one you have problems with.

Then if the problem persists, show what the difference is between the
user's preferences when the plugin is working and what they are when
you log in next and it's not working. Are you certain your
preferences are saving correctly?

Have you tested with error reporting turned up all the way? Do you
see PHP errors?

> Thanks in advance for you help and sorry for my poor english
>
> Best Regards
>
> Ansley
>
>
> squirrelmail 1.4.19
>
> plugins enabled
> $plugins[0] = 'compatibility';
> $plugins[1] = 'secure_login';
> $plugins[2] = 'download_all';
> $plugins[3] = 'email_footer';
> $plugins[4] = 'extract';
> $plugins[5] = 'folder_sizes';
> $plugins[6] = 'folder_synch';
> $plugins[7] = 'html_mail';
> $plugins[8] = 'msg_flags';
> $plugins[9] = 'quicksave';
> $plugins[10] = 'reply_buttons';
> $plugins[11] = 'delete_move_next';
> $plugins[12] = 'select_range';
> $plugins[13] = 'view_as_html';
> $plugins[14] = 'addgraphics';
> $plugins[15] = 'abook_import_export';
> $plugins[16] = 'admin_add';
> $plugins[17] = 'administrator';
> $plugins[18] = 'archive_mail';
> $plugins[19] = 'change_pass';
> $plugins[20] = 'calendar';
> $plugins[21] = 'attachment_doc';
> $plugins[22] = 'add_address';
> $plugins[23] = 'cleanup';
>
> OS RedHat Linux 2.6.18-8.1.8.el5

Preferences or plugins not applied correctly

2009-11-06T12:23:24Z

When users login some plugins does not load correctly (such selct_range and html_mail). For select_range , no link is added in the message list; for html_mail ,no editor is loaded in the compose page.I have to go to the display preferences page and only click the save button to have theses plugins to work as expected.And at the next login , although the parameters related to these plugins are presents whith the settings I've defined in the display preferences page, I must click before the save button to have thes to work.

Thanks in advance for you help and sorry for my poor english

Best Regards

Ansley

squirrelmail 1.4.19

plugins enabled
$plugins[0] = 'compatibility';
$plugins[1] = 'secure_login';
$plugins[2] = 'download_all';
$plugins[3] = 'email_footer';
$plugins[4] = 'extract';
$plugins[5] = 'folder_sizes';
$plugins[6] = 'folder_synch';
$plugins[7] = 'html_mail';
$plugins[8] = 'msg_flags';
$plugins[9] = 'quicksave';
$plugins[10] = 'reply_buttons';
$plugins[11] = 'delete_move_next';
$plugins[12] = 'select_range';
$plugins[13] = 'view_as_html';
$plugins[14] = 'addgraphics';
$plugins[15] = 'abook_import_export';
$plugins[16] = 'admin_add';
$plugins[17] = 'administrator';
$plugins[18] = 'archive_mail';
$plugins[19] = 'change_pass';
$plugins[20] = 'calendar';
$plugins[21] = 'attachment_doc';
$plugins[22] = 'add_address';
$plugins[23] = 'cleanup';

OS RedHat Linux 2.6.18-8.1.8.el5

Achetez un nouveau PC et bénéficiez de Windows 7 dès sa sortie ! En savoir plus
------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: "Undefined variable: charset" messages

2009-11-05T23:02:47Z

2009.11.06 02:12 Andrew Daviel rašė:

>
> (in a previous version I hacked squirrelmail to stop these; I forget what
> I did and now they're back after an update. Obviously it's better to get
> the code fixed or find the underlying problem...)
>
> I get a ton of PHP warnings in https/ssl_error_log, viz.
>
> PHP Notice: Undefined variable: charset in
> /usr/share/squirrelmail/functions/mime.php on line 317, referer:
> ...squirrelmail/src/right_main.php
>
> any ideas ?
>
> Seems to me like $charset is not getting transferred into formatBody()
> from whereever.
>
> RedHat Enterprise 4 (compatible)
> php-4.3.9-3.22.15.i386
> squirrelmail-1.4.8-5.el4_8.8.noarch

Fedora removed squirrelmail-1.4.8-IE-Japanese-download-ugly-hack.patch two
years ago. Looks like new package maintainer decided to keep it in RHEL
packages and even extended it. Patch is broken. Ask RH to remove it or
explain all modifications to upstream. They don't have to explain
modification in SendDownloadHeaders() function, but even there they are
testing only for Japanese, when problem also exists in Korean and Chinese.

--
Tomas

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: "Undefined variable: charset" messages

2009-11-05T17:51:13Z

On Thu, Nov 5, 2009 at 4:12 PM, Andrew Daviel <advax@...> wrote:

Unless you can reproduce using the latest SM code, you need to contact RedHat.

--
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: SM in phishing attacks - obtaining passwords

2009-11-05T17:50:10Z

On Nov 5, 2009, at 6:48 PM, Andrew Daviel wrote:

> I was wondering what other admin's experience has been with
> compromised
> SM accounts, and how spammers are able to obtain passwords.

Spear phishing... Your user gave it to them. Search for it in their
Sent mail. I expect you'll find it in the past couple of months.

> Certainly, we see a lot of webmail phishing from .edu domains,
> although I don't believe
> we ourselves have ever been previously compromised like this.
>
> I'm still somewhat concerned; it's as if the spammers deliberately
> chose
> to use some lightly-used accounts where the owners might not notice,
> and
> perhaps have a pool of others available.

It's not 'as if', they actively are. High-Ed and K12 have been dealing
with this for years now. They do have a pool of accounts. They may
obtain a password for an account and not actually use it to send spam
or other phishing attempts until a month or two later. They're
targeting webmail users, seemingly SM users in particular. They send e-
mails claiming to be your support staff saying that they need to
upgrade the mail system, fix some broken part of it, etc and need the
user to confirm their account information in order to keep their
account. You'd be surprised at how many happily oblige. These people
are not really very sophisticated. They depend on the gullibility of
the users to get the account info and manually send spam from the
accounts. For SM, they typically change the reply-to address and use
the signature for the spam payload. That way, they just need to copy/
paste the To:/Bcc: addresses...

> It would be nice to assume that
> the problem is all client-end - malware, conficker worm, or phishing -
> but the small volume on these accounts implies a reduced chance of
> receiving phishing messages or infected attachments compared to the
> typical always-online user.

Spear phishing has been our experience 100% of the time.

--
Marc

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Logging users vs. ip address

2009-11-05T17:46:19Z

On Thu, Nov 5, 2009 at 4:12 PM, Andrew Daviel <advax@...> wrote:

> On Wed, 4 Nov 2009, Tomas Kuliavas wrote:
>
>>> I'm sure there's a better, more elegant way, probably already done by
>>> someone - maybe "Squirrel Logger" plugin which I hadn't found when I
>>> wrote this. But for what it's worth:
>
>> Your both changes are added right after hook calls. There is no need to
>> modify SquirrelMail code. Plugin can be attached to those hooks.
>
> That's just me hacking something without actually understanding it :-)
>
> I just installed the logger plugin and that's writing to a file OK.
> But I can't get the syslog or email alerting to work - if I cause an
> error (deliberate login failure) I get a blank page for
> squirrelmail/src/redirect.php

http://squirrelmail.org/docs/admin/admin-11.html#blankpage

> I installed the compatability plugin per the docs (requires patching
> SquirrelMail it seems)

Only if using out-of-date version of SM

> but still no good.

--
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

SM in phishing attacks - obtaining passwords

2009-11-05T16:48:06Z

On Sat, 31 Oct 2009, Paul Lesniewski wrote:
(re. Forcing a logout )

> You can (could have) stopped this almost right away with MTA
> rate-limiting or by using the Restrict Senders plugin. The Squirrel
> Logger plugin could also have alerted you to the problem. If the
> attacker got the password by guessing on the login page, you can use
> the Lockout and/or CAPTCHA plugins to block such attempts.

We only have ~1K accounts and haven't had this trouble before, so had
nothing in place to deal with it. I think our MTA rate-limits before
expanding recipient lists so didn't kick in, or not much.

As far as I can tell from webserver logs, there was no significant
attempt at brute-forcing accounts. At least, not recently.
Most of the accounts used had 8-character random passwords that we
assigned - unlikely to be brute-forced in any case, if the pattern I've
seen in SSH is any clue.

I was wondering what other admin's experience has been with compromised
SM accounts, and how spammers are able to obtain passwords. Certainly, we
see a lot of webmail phishing from .edu domains, although I don't believe
we ourselves have ever been previously compromised like this.

I'm still somewhat concerned; it's as if the spammers deliberately chose
to use some lightly-used accounts where the owners might not notice, and
perhaps have a pool of others available. It would be nice to assume that
the problem is all client-end - malware, conficker worm, or phishing -
but the small volume on these accounts implies a reduced chance of
receiving phishing messages or infected attachments compared to the
typical always-online user.

--
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376 (Pacific Time)
Network Security Manager

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Forcing a logout (invalidating current session)

2009-11-05T16:28:27Z

On Sat, 31 Oct 2009, Paul Lesniewski wrote:

> On Fri, Oct 30, 2009 at 2:07 PM, Andrew Daviel <advax@...> wrote:
>>
>> We had a user account compromised somehow (bad guys got the password).
>>
>> The user has changed their password.
>> How can I kick off any logged-in sessions and make sure they can't login
>> without knowing the new password ?
>
> As others have suggested, restart imapproxy if you use it and grep for
> PHP session files with the username in them and delete those. That's
> probably the least intrusive (to any other users) method.

Thanks to Tomas' suggestion, I ran phpinfo.php and found the session logs
in /var/lib/php/session
Format is ugly but a grep for '"username";user_is_logged_in"
seems to work.

Whe I click on "compose" after locking my account (no imapproxy) I get an
immediate failure, so I'm not sure killing the session files is
necessary, but it won't hurt.

I also found a good number of deferred messages (naturally) in the
sendmail queue I was able to remove. I found docs on how to move them to
a quarantine queue in the sendmail manpages, but not how to actually
delete them. Zapped them with a bit of sed/grep pipefitting.

--
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376 (Pacific Time)
Network Security Manager

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Logging users vs. ip address

2009-11-05T16:12:29Z

On Wed, 4 Nov 2009, Tomas Kuliavas wrote:

>> I'm sure there's a better, more elegant way, probably already done by
>> someone - maybe "Squirrel Logger" plugin which I hadn't found when I
>> wrote this. But for what it's worth:

> Your both changes are added right after hook calls. There is no need to
> modify SquirrelMail code. Plugin can be attached to those hooks.

That's just me hacking something without actually understanding it :-)

I just installed the logger plugin and that's writing to a file OK.
But I can't get the syslog or email alerting to work - if I cause an
error (deliberate login failure) I get a blank page for
squirrelmail/src/redirect.php

I installed the compatability plugin per the docs (requires patching
SquirrelMail it seems) but still no good.

--
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376 (Pacific Time)
Network Security Manager

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

"Undefined variable: charset" messages

2009-11-05T16:12:10Z

(in a previous version I hacked squirrelmail to stop these; I forget what
I did and now they're back after an update. Obviously it's better to get
the code fixed or find the underlying problem...)

I get a ton of PHP warnings in https/ssl_error_log, viz.

PHP Notice: Undefined variable: charset in
/usr/share/squirrelmail/functions/mime.php on line 317, referer:
...squirrelmail/src/right_main.php

any ideas ?

Seems to me like $charset is not getting transferred into formatBody()
from whereever.

RedHat Enterprise 4 (compatible)
php-4.3.9-3.22.15.i386
squirrelmail-1.4.8-5.el4_8.8.noarch

--
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376 (Pacific Time)
Network Security Manager

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: VERY slow squirrelmail response

2009-11-05T03:32:14Z

Velda Midanovic wrote:

So I have a problem.

My system : RH4U5

No additional plugins, just bare squirrel.

PHP : php-4.3.9-3.22.4
HTTP : Apache, httpd-2.0.52-41.ent.4
IMAP : imap-2002d-12
Kernel : 2.6.9-78.0.17.Elsmp

All of the above was installed with the instalation of the OS, or
additionally as RPM packages.

There are no errors, at least none that I can find. Squirrelmail is working,
it is just VERY slow, even when I log to port 143 directly on a server, both
to its IP address, and on loopback :
...
Any Ideas?

Disable reverse dns lookups in your IMAP server. It is some secret unsupported option described in imaprc.txt (http://www.washington.edu/imap/documentation/imaprc.txt.html)

Try starting local ident service or see http://www.washington.edu/imap/IMAP-FAQs/index.html#7.24

Get better IMAP server.

--
Tomas

Re: No href links in left_main for most folders

2009-11-04T13:55:26Z

On Wed, November 4, 2009 14:53, James B. Byrne wrote:
>
> Since early today I am experiencing the situation where all but a
> very few folder in my imap account have associated hrefs generated
> for them when the folders are displayed in the left_main frame.
> This problem seems to affect only my account. I have had one other
> user sign on to squirrelmail and their folders are linked as
> expected.

I discovered from looking in the maillog file that my cycrus-imap
user.seen database was corrupted. I followed the instructions found
at http://article.gmane.org/gmane.mail.imap.cyrus/18840, recovered
the database, and now SM is working for me.

Briefly, the procedure is:

locate the bad record in the seen database, given as a hex number in
the maillog entry:

Nov 4 16:24:58 inet07 imap[10864]: DBERROR: skiplist recovery
/var/lib/imap/user/b/byrnejb.seen: ADD at AFB8 exists

and convert the hex value to decimal: xAFB8 = d44984. Next,
disconnect all MUAs connected to the problem user account. Now
recover the old database to the point of corruption.

Log onto the imap host as root.

# cd /var/lib/imap/user/b

Use dd to copy the old seen db up to the point of corruption:

# dd if=byrnejb.seen of=byrnejb.seen.fixed bs=1 count=44984

Copy the recovered DB over the corrupted one.

# mv byrnejb.seen.fixed byrnejb.seen

Set the ownership and permissions so that the imap server can open
and modify the database.

# chown cyrus:mail byrnejb.seen

The DB is now recovered. Connect to the mail account from
SquirrelMail. Squirrelmail now handles the folders as expected.

Interestingly enough, ThunderBird allowed me to open every folder
and all email notwithstanding that the DB was corrupted. What
twigged me to the idea that it might be a server error is that all
the messages in every folder were set to unseen and marking them to
seen did not permanently alter their status. Every time I opened a
previously visited folder all the messages I had just marked as seen
were in unseen status again.

--
*** E-Mail is NOT a SECURE channel ***
James B. Byrne mailto:ByrneJB@...
Harte & Lyne Limited http://www.harte-lyne.ca
9 Brockley Drive vox: +1 905 561 1241
Hamilton, Ontario fax: +1 905 561 0757
Canada L8E 3C3

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

No href links in left_main for most folders

2009-11-04T11:53:35Z

workstation: CentOS-5.4 kernel-2.6.18-164.2.1.el5
browser: firefox-3.0.15-3.el5.centos

Since early today I am experiencing the situation where all but a
very few folder in my imap account have associated hrefs generated
for them when the folders are displayed in the left_main frame.
This problem seems to affect only my account. I have had one other
user sign on to squirrelmail and their folders are linked as
expected.

I have tried closing and restarting the httpd server, my browser, my
session and I have even rebooted my workstation. None of these
actions have cleared the problem.

I have no idea what is causing this, how it happened, or how to
correct it. Any ideas?

SquirrelMail configtest

This script will try to check some aspects of your SquirrelMail
configuration and point you to errors whereever it can find them.
You need to go run conf.pl in the config/ directory first before you
run this script.

SquirrelMail version: 1.4.8-5.el4.centos.8
Config file version: 1.4.0
Config file last modified: 04 November 2009 10:19:49
Checking PHP configuration...
PHP version 5.1.6 OK.
PHP extensions OK.
Checking paths...
Data dir OK.
Attachment dir OK.
Plugins OK.
Themes OK.
Default language OK.
Base URL detected as: https://webmail.harte-lyne.ca/webmail/src
(location base autodetected)
Checking outgoing mail service....
SMTP server OK (220 inet07.hamilton.harte-lyne.ca ESMTP Sendmail
8.13.1/8.13.1; Wed, 4 Nov 2009 14:50:00 -0500)
Checking IMAP service....
IMAP server ready (* OK inet07.hamilton.harte-lyne.ca Cyrus
IMAP4 v2.2.12-Invoca-RPM-2.2.12-10.el4_8.4 server ready)
Capabilities: * CAPABILITY IMAP4 IMAP4rev1 ACL QUOTA LITERAL+
MAILBOX-REFERRALS NAMESPACE UIDPLUS ID NO_ATOMIC_RENAME UNSELECT
CHILDREN MULTIAPPEND BINARY SORT THREAD=ORDEREDSUBJECT
THREAD=REFERENCES ANNOTATEMORE IDLE STARTTLS LISTEXT
LIST-SUBSCRIBED X-NETSCAPE
Checking internationalization (i18n) settings...
gettext - Gettext functions are available. You must have
appropriate system locales compiled.
mbstring - Mbstring functions are available.
recode - Recode functions are unavailable.
iconv - Iconv functions are available.
timezone - Webmail users can change their time zone settings.
Checking database functions...
not using database functionality.

Congratulations, your SquirrelMail setup looks fine to me!

The left_main frame has this html:

<td align="center">
Folders 

Last Refresh: 2009-11-04 14:50 EST (<a href="../src/left_main.php"
target="left">Check mail</a>)</td></tr></table> <tt><a target="left"
style="text-decoration:none"
href="left_main.php?fold=INBOX">-</a> </tt>INBOX 

<tt> </tt>Drafts 
<tt> </tt>Sent 
<tt> </tt>Trash

 (<a href="empty_trash.php"
style="text-decoration:none">Purge</a>) 

There are no hrefs generated for INBOX, Drafts, Sent or Trash yet
the purge link is generated.

--
*** E-Mail is NOT a SECURE channel ***
James B. Byrne mailto:ByrneJB@...
Harte & Lyne Limited http://www.harte-lyne.ca
9 Brockley Drive vox: +1 905 561 1241
Hamilton, Ontario fax: +1 905 561 0757
Canada L8E 3C3

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: different mail accounts on the same machine

2009-11-04T09:20:17Z

On Wed, Nov 4, 2009 at 5:42 AM, fakessh@... <fakessh@...> wrote:

> Hi all
> Hi list
>
>
> hello, my linux box is a Centos 5.4 update correctly
>
> [root@r13151 ~]# rpm -qa | grep squirrelmail
> squirrelmail-1.4.8-5.el5.centos.10
>
> I'm going to walk the couple postfix dovecot
>
> [root@r13151 ~]# rpm -qa | grep postfix
> postfix-2.5.1-1.mysql.sasl2.vda.rhel5
> [root@r13151 ~]# rpm -qa | grep dovecot
> dovecot-1.0.7-7.el5
>
> my imap and smtp server using tls and authentication PLAIN
> Is it possible to configure squirellmail ,simply , just to keep
> my "pre-requires" :PLAIN and TLS, postfix use mysql , dovecot use mysql
>
> different accounts work with normal email client: thunderbird kmail
> individual accounts are different domain names I own that are hosted on the
> same machine
>
> [root@r13151 ~]# ls -All /usr/share/squirrelmail/
> total 44
> drwxr-xr-x 5 root root 4096 nov 4 13:31 class
> drwxr-xr-x 2 root root 4096 nov 4 13:31 config
> drwxr-xr-x 4 root root 4096 nov 4 13:31 functions
> drwxr-xr-x 30 root root 4096 nov 4 13:31 help
> drwxr-xr-x 2 root root 4096 nov 4 13:31 images
> drwxr-xr-x 3 root root 4096 nov 4 13:31 include
> -rw-r--r-- 1 root root 684 oct 27 02:14 index.php
> drwxr-xr-x 47 root root 4096 nov 4 13:31 locale
> drwxr-xr-x 18 root root 4096 nov 4 13:31 plugins
> drwxr-xr-x 2 root root 4096 nov 4 13:31 src
> drwxr-xr-x 3 root root 4096 nov 4 13:31 themes
> [root@r13151 ~]#
>
>
> [root@r13151 ~]# ls -All /etc/squirrelmail/
> total 36
> -rw-r----- 1 root apache 499 oct 27 02:14 config_local.php
> -rw-r----- 1 root apache 6502 oct 27 02:14 config.php
> -rw-r----- 1 root apache 6901 oct 8 23:35 config.php~
> -rw-r----- 1 root apache 6983 nov 1 21:07 config.php.rpmsave
> -rw-r----- 1 root apache 65 oct 27 02:14 default_pref
> -rw-r----- 1 root apache 1054 oct 27 02:14 sqspell_config.php
> [root@r13151 ~]#
>
>
> the apache server is configured correctly http://onedomain/webmail displays
> well the login page of Webmail
>
> how to configure webmail to use multiple domain names on the same machine
> example :
> http://Adomain/webmail and http://Bdomain/webmail
>
> I can detail the exact procedure to follow.
> I know there is a program
> [r13151 root @ ~] # perl /usr/share/squirrelmail/config/conf.pl
> to complete the setup webmail
> Please describe me the best ways to configure squirellmail

http://squirrelmail.org/docs/admin/admin.html

You may be interested in the Login Manager plugin.

Otherwise, if you have *specific* questions, you must search for
answers in our mailing list archives and if you don't find an answer,
you can ask the question here.

--
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

squirrelmail + dns srv records

2009-11-04T08:43:55Z

hi...

Squirrelmail support dns srv registers... for ldap service?

thanks in advance :)

--
Salu2 ;)

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

different mail accounts on the same machine

2009-11-04T05:42:02Z

Hi all
Hi list

hello, my linux box is a Centos 5.4 update correctly

[root@r13151 ~]# rpm -qa | grep squirrelmail
squirrelmail-1.4.8-5.el5.centos.10

I'm going to walk the couple postfix dovecot

[root@r13151 ~]# rpm -qa | grep postfix
postfix-2.5.1-1.mysql.sasl2.vda.rhel5
[root@r13151 ~]# rpm -qa | grep dovecot
dovecot-1.0.7-7.el5

my imap and smtp server using tls and authentication PLAIN
Is it possible to configure squirellmail ,simply , just to keep
my "pre-requires" :PLAIN and TLS, postfix use mysql , dovecot use mysql

different accounts work with normal email client: thunderbird kmail
individual accounts are different domain names I own that are hosted on the
same machine

[root@r13151 ~]# ls -All /usr/share/squirrelmail/
total 44
drwxr-xr-x 5 root root 4096 nov 4 13:31 class
drwxr-xr-x 2 root root 4096 nov 4 13:31 config
drwxr-xr-x 4 root root 4096 nov 4 13:31 functions
drwxr-xr-x 30 root root 4096 nov 4 13:31 help
drwxr-xr-x 2 root root 4096 nov 4 13:31 images
drwxr-xr-x 3 root root 4096 nov 4 13:31 include
-rw-r--r-- 1 root root 684 oct 27 02:14 index.php
drwxr-xr-x 47 root root 4096 nov 4 13:31 locale
drwxr-xr-x 18 root root 4096 nov 4 13:31 plugins
drwxr-xr-x 2 root root 4096 nov 4 13:31 src
drwxr-xr-x 3 root root 4096 nov 4 13:31 themes
[root@r13151 ~]#

[root@r13151 ~]# ls -All /etc/squirrelmail/
total 36
-rw-r----- 1 root apache 499 oct 27 02:14 config_local.php
-rw-r----- 1 root apache 6502 oct 27 02:14 config.php
-rw-r----- 1 root apache 6901 oct 8 23:35 config.php~
-rw-r----- 1 root apache 6983 nov 1 21:07 config.php.rpmsave
-rw-r----- 1 root apache 65 oct 27 02:14 default_pref
-rw-r----- 1 root apache 1054 oct 27 02:14 sqspell_config.php
[root@r13151 ~]#

the apache server is configured correctly http://onedomain/webmail displays
well the login page of Webmail

how to configure webmail to use multiple domain names on the same machine
example :
http://Adomain/webmail and http://Bdomain/webmail

I can detail the exact procedure to follow.
I know there is a program
[r13151 root @ ~] # perl /usr/share/squirrelmail/config/conf.pl
to complete the setup webmail
Please describe me the best ways to configure squirellmail

Excuse my bad English I'm French

thanks for all your feedbacks

SL

nb : 'Buddha' peace themselve

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

VERY slow squirrelmail response

2009-11-04T03:23:52Z

So I have a problem.

My system : RH4U5

No additional plugins, just bare squirrel.

PHP : php-4.3.9-3.22.4

HTTP : Apache, httpd-2.0.52-41.ent.4

IMAP : imap-2002d-12

Kernel : 2.6.9-78.0.17.Elsmp

All of the above was installed with the instalation of the OS, or additionally as RPM packages.

There are no errors, at least none that I can find. Squirrelmail is working, it is just VERY slow, even when I log to port 143 directly on a server, both to its IP address, and on loopback :

# telnet 127.0.0.1 143

Trying 127.0.0.1...

Connected to localhost.localdomain (127.0.0.1).

Escape character is '^]'.

***********

Here is the delay, and it is almost 30 seconds!!!!!

The line below shows after the 30 second delay, and I am doing the telnet on the server itself.

***********

* OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS STARTTLS AUTH=LOGIN] localhost.localdomain IMAP4rev1 2003.338rh at Wed, 4 Nov 2009 12:03:26 +0100 (CET)

Any Ideas?

Best regards,

Velda

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Logging users vs. ip address

2009-11-03T22:16:20Z

On Tue, Nov 3, 2009 at 1:08 PM, Andrew Daviel <advax@...> wrote:

Yep, that's the one you want that does what you're trying to do in a
much better way. You also want Restrict Senders and maybe Lockout
and/or CAPTCHA

> when I
> wrote this. But for what it's worth:
>
> patch aginst squirrelmail-1.4.8-5.el4 (Latest RedHat Enterprise 4
> package) - generates a simple greppable file of logins and logouts :
>
>
> --- /usr/share/squirrelmail/src/redirect.php.orig 2009-01-20
> 21:21:31.000000000 -0800
> +++ /usr/share/squirrelmail/src/redirect.php 2009-10-23
> 16:56:03.000000000 -0700
> @@ -99,7 +99,11 @@
> sqsession_register ($username, 'username');
> sqsetcookie('key', $key, 0, $base_uri);
> do_hook ('login_verified');
> -
> + if ($logfile = fopen('/var/log/squirrelmail/session.log','a+') ) {
> + $logline = date('Y-m-d H:i:s ') . $_SERVER['REMOTE_ADDR'] . ' login ' . $username . "\n";
> + fputs($logfile, $logline, strlen($logline) );
> + fclose($logfile);
> + }
> }
>
> /* Set the login variables. */
> --- /usr/share/squirrelmail/src/signout.php.orig 2006-07-30
> 12:37:38.000000000 -0700
> +++ /usr/share/squirrelmail/src/signout.php 2009-10-23
> 18:10:51.000000000 -0700
> @@ -43,6 +43,11 @@
> }
>
> do_hook('logout');
> +if ($logfile = fopen('/var/log/squirrelmail/session.log','a+') ) {
> + $logline = date('Y-m-d H:i:s ') . $_SERVER['REMOTE_ADDR'] . ' logout ' . $username . "\n";
> + fputs($logfile, $logline, strlen($logline) );
> + fclose($logfile);
> +}
>
> sqsession_destroy();
>
> ---------------------
> /var/log/squirrelmail needs to exist, writable by apache
> (PHP is not my choice of scripting language, so this is way crude ...)

Re: Logging users vs. ip address

2009-11-03T21:14:40Z

2009.11.03 23:08 Andrew Daviel rašė:

>
> We have been having problems with compromised accounts used for spamming,
> and I needed to track user logins against client ip address.
>
> The remote address turns up in the Message-ID, e.g.
> <port>.<ipv4a.b.c.d>.nnnn.squirrel...
> and in Apache access_log, but those don't give the username.
> imapd syslog gives the username, but lists 127.0.0.1 as the address.
> Correlating timestamps was painful, so I hacked squirrelmail.
>
> I'm sure there's a better, more elegant way, probably already done by
> someone - maybe "Squirrel Logger" plugin which I hadn't found when I
> wrote this. But for what it's worth:
>
> patch aginst squirrelmail-1.4.8-5.el4 (Latest RedHat Enterprise 4
> package) - generates a simple greppable file of logins and logouts :
>
>
> --- /usr/share/squirrelmail/src/redirect.php.orig 2009-01-20
> 21:21:31.000000000 -0800
> +++ /usr/share/squirrelmail/src/redirect.php 2009-10-23
> 16:56:03.000000000 -0700
> @@ -99,7 +99,11 @@
> sqsession_register ($username, 'username');
> sqsetcookie('key', $key, 0, $base_uri);
> do_hook ('login_verified');
> -
> + if ($logfile = fopen('/var/log/squirrelmail/session.log','a+') ) {
> + $logline = date('Y-m-d H:i:s ') . $_SERVER['REMOTE_ADDR'] . ' login
> ' . $username . "\n";
> + fputs($logfile, $logline, strlen($logline) );
> + fclose($logfile);
> + }
> }
>
> /* Set the login variables. */
> --- /usr/share/squirrelmail/src/signout.php.orig 2006-07-30
> 12:37:38.000000000 -0700
> +++ /usr/share/squirrelmail/src/signout.php 2009-10-23
> 18:10:51.000000000 -0700
> @@ -43,6 +43,11 @@
> }
>
> do_hook('logout');
> +if ($logfile = fopen('/var/log/squirrelmail/session.log','a+') ) {
> + $logline = date('Y-m-d H:i:s ') . $_SERVER['REMOTE_ADDR'] . ' logout '
> . $username . "\n";
> + fputs($logfile, $logline, strlen($logline) );
> + fclose($logfile);
> +}
>
> sqsession_destroy();
>
> ---------------------
> /var/log/squirrelmail needs to exist, writable by apache
> (PHP is not my choice of scripting language, so this is way crude ...)

See PHP error_log() and syslog() documentation. There is no need to do
fopen stuff.

date() is sensitive to timezone. Not good for logs.

you should also log login failures.

Your both changes are added right after hook calls. There is no need to
modify SquirrelMail code. Plugin can be attached to those hooks.

--
Tomas

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Logging users vs. ip address

2009-11-03T13:08:49Z

We have been having problems with compromised accounts used for spamming,
and I needed to track user logins against client ip address.

The remote address turns up in the Message-ID, e.g.
<port>.<ipv4a.b.c.d>.nnnn.squirrel...
and in Apache access_log, but those don't give the username.
imapd syslog gives the username, but lists 127.0.0.1 as the address.
Correlating timestamps was painful, so I hacked squirrelmail.

I'm sure there's a better, more elegant way, probably already done by
someone - maybe "Squirrel Logger" plugin which I hadn't found when I
wrote this. But for what it's worth:

patch aginst squirrelmail-1.4.8-5.el4 (Latest RedHat Enterprise 4
package) - generates a simple greppable file of logins and logouts :

--- /usr/share/squirrelmail/src/redirect.php.orig 2009-01-20
21:21:31.000000000 -0800
+++ /usr/share/squirrelmail/src/redirect.php 2009-10-23
16:56:03.000000000 -0700
@@ -99,7 +99,11 @@
sqsession_register ($username, 'username');
sqsetcookie('key', $key, 0, $base_uri);
do_hook ('login_verified');
-
+ if ($logfile = fopen('/var/log/squirrelmail/session.log','a+') ) {
+ $logline = date('Y-m-d H:i:s ') . $_SERVER['REMOTE_ADDR'] . ' login ' . $username . "\n";
+ fputs($logfile, $logline, strlen($logline) );
+ fclose($logfile);
+ }
}

/* Set the login variables. */
--- /usr/share/squirrelmail/src/signout.php.orig 2006-07-30
12:37:38.000000000 -0700
+++ /usr/share/squirrelmail/src/signout.php 2009-10-23
18:10:51.000000000 -0700
@@ -43,6 +43,11 @@
}

do_hook('logout');
+if ($logfile = fopen('/var/log/squirrelmail/session.log','a+') ) {
+ $logline = date('Y-m-d H:i:s ') . $_SERVER['REMOTE_ADDR'] . ' logout ' . $username . "\n";
+ fputs($logfile, $logline, strlen($logline) );
+ fclose($logfile);
+}

sqsession_destroy();

---------------------
/var/log/squirrelmail needs to exist, writable by apache
(PHP is not my choice of scripting language, so this is way crude ...)

--
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376 (Pacific Time)
Network Security Manager

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Bug Report

2009-11-02T06:28:42Z

> I subscribe to the squirrelmail-users mailing list.
> [ ] True - No need to CC me when replying
> [x] False - Please CC me when replying
>
> This bug occurs when I ...
> ..x. view a particular message
> ... use a specific plugin/function
> ... try to do/view/use ....
>
> The description of the bug:It will not let me delete message from HP and
> some unknown messages
>
> I can reproduce the bug by:Trying to delete the above

Are you the system administrator of your mail system? If not, please
contact your system administrator so he/she can help you out.

http://squirrelmail.org/support/enduser.php

If you are the system administrator, please describe the possible bug with
more details.

http://squirrelmail.org/support/administrator.php

> ----------------------------------------------
>
> My browser information:
> Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; Trident/4.0;
> FBSMTWB; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR
> 3.0.30618; .NET CLR 3.5.30729)
>
> My web server information:
> PHP Version 5.2.9
> PHP Extensions (List)
> * 0 = session
> * 1 = Reflection
> * 2 = date
> * 3 = libxml
> * 4 = apache2handler
> * 5 = ctype
> * 6 = pcre
> * 7 = SimpleXML
> * 8 = SPL
> * 9 = dom
> * 10 = fileinfo
> * 11 = filter
> * 12 = gd
> * 13 = gettext
> * 14 = hash
> * 15 = iconv
> * 16 = standard
> * 17 = json
> * 18 = mbstring
> * 19 = mcrypt
> * 20 = mhash
> * 21 = mysql
> * 22 = mysqli
> * 23 = openssl
> * 24 = PDO
> * 25 = pdo_sqlite
> * 26 = posix
> * 27 = imap
> * 28 = pspell
> * 29 = SQLite
> * 30 = tokenizer
> * 31 = xml
> * 32 = xmlreader
> * 33 = xmlwriter
> * 34 = zip
>
>
> SquirrelMail-specific information:
> Version: 1.4.16
> Plugins (List)
> * 0 = abook_group
> * 1 = abook_take
> * 2 = bookmarks
> * 3 = bug_report
> * 4 = calendar
> * 5 = compatibility
> * 6 = delete_move_next
> * 7 =
> * 8 =
> * 9 = html_mail
> * 10 = listcommands
> * 11 = vlogin
> * 12 = login_auto
> * 13 = mail_fetch
> * 14 = message_details
> * 15 = msg_flags
> * 16 = newmail
> * 17 = notes
> * 18 = preview_pane
> * 19 = sent_subfolders
> * 20 = show_user_and_ip
> * 21 = smallcal
> * 22 =
> * 23 = squirrelspell
> * 24 =
> * 25 = todo
> * 26 = translate
> * 27 = view_as_html
> * 28 =
> * 29 = calendar_sql_backend
> * 30 =
> * 31 = restrict_senders
> * 32 = amavisnewsql
> * 33 = postfixadmin
> * 34 = lockout
> * 35 = unsafe_image_rules
>
>
> My IMAP server information:
> Server type: courier
> Server info: * OK [HIDDEN] IMAP4rev1 UIDPLUS CHILDREN NAMESPACE
> THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION
> STARTTLS] Courier-IMAP ready. Copyright 1998-2008 Double Precision, Inc.
> See COPYING for distribution information.
> Capabilities: IMAP4rev1 UIDPLUS CHILDREN NAMESPACE
> THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION
> STARTTLS

--
Fredrik Jervfors
The SquirrelMail Project
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donations.php

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Squirrel Logger Install Issues

2009-11-01T19:24:05Z

On Sun, Nov 1, 2009 at 4:36 PM, John Espiro <john_espiro@...> wrote:

> Greetings everyone...
>
> I am trying to get the "Squirrel Logger" plugin
> (http://squirrelmail.org/plugin_view.php?id=52) to work.
>
> I installed it, configured it, restarted apache and sendmail, and no
> matter what I try, nothing gets logged and I see no errors or
> information being written to any of the log files.
>
> Can someone help me out in terms of what I need to do o get this to
> work? I've included all of the details of my install below...

How can anyone possibly do that if you don't tell us how you
configured it? You should also read the mailing list posting
guidelines, paying attention especially to the part about how to
enable error reporting in your PHP configuration.

> SquirrelMail version 1.4.8-5.el4.centos.8

FYI, we don't officially support third party vendor ports of our code.
If your problem is caused by their changes (hopefully it's not), you
have to work with them.

> PHP 5.2.11
> Server version: Apache/2.0.52
> Sendmail: Version 8.13.1
> CentOS 4
> Squirrelmail installed with yum
> Browsers: N/A
>
> Installed plugins:
> 1. delete_move_next
> 2. squirrelspell
> 3. newmail
> 4. listcommands
> 5. custom_from
> 6. calendar
> 7. compatibility
> 8. autocomplete
> 9. admin_add
> 10. administrator
> 11. squirrel_logger
> 12. html_mail
> 13. check_quota
> 14. add_address
> 15. quicksave
> 16. folder_sizes
> 17. msg_flags

--
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Squirrel Logger Install Issues

2009-11-01T16:36:29Z

Greetings everyone...

I am trying to get the "Squirrel Logger" plugin
(http://squirrelmail.org/plugin_view.php?id=52) to work.

I installed it, configured it, restarted apache and sendmail, and no
matter what I try, nothing gets logged and I see no errors or
information being written to any of the log files.

Can someone help me out in terms of what I need to do o get this to
work? I've included all of the details of my install below...

Thanks,
John

SquirrelMail version 1.4.8-5.el4.centos.8
PHP 5.2.11
Server version: Apache/2.0.52
Sendmail: Version 8.13.1
CentOS 4
Squirrelmail installed with yum
Browsers: N/A

Installed plugins:
1. delete_move_next
2. squirrelspell
3. newmail
4. listcommands
5. custom_from
6. calendar
7. compatibility
8. autocomplete
9. admin_add
10. administrator
11. squirrel_logger
12. html_mail
13. check_quota
14. add_address
15. quicksave
16. folder_sizes
17. msg_flags

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Bug Report

2009-11-01T03:20:28Z

I subscribe to the squirrelmail-users mailing list.
[ ] True - No need to CC me when replying
[x] False - Please CC me when replying

This bug occurs when I ...
..x. view a particular message
... use a specific plugin/function
... try to do/view/use ....

The description of the bug:It will not let me delete message from HP and
some unknown messages

I can reproduce the bug by:Trying to delete the above

(Optional) I got bored and found the bug occurs in:

(Optional) I got really bored and here's a fix:

----------------------------------------------

My browser information:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; Trident/4.0;
FBSMTWB; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR
3.0.30618; .NET CLR 3.5.30729)

My web server information:
PHP Version 5.2.9
PHP Extensions (List)
* 0 = session
* 1 = Reflection
* 2 = date
* 3 = libxml
* 4 = apache2handler
* 5 = ctype
* 6 = pcre
* 7 = SimpleXML
* 8 = SPL
* 9 = dom
* 10 = fileinfo
* 11 = filter
* 12 = gd
* 13 = gettext
* 14 = hash
* 15 = iconv
* 16 = standard
* 17 = json
* 18 = mbstring
* 19 = mcrypt
* 20 = mhash
* 21 = mysql
* 22 = mysqli
* 23 = openssl
* 24 = PDO
* 25 = pdo_sqlite
* 26 = posix
* 27 = imap
* 28 = pspell
* 29 = SQLite
* 30 = tokenizer
* 31 = xml
* 32 = xmlreader
* 33 = xmlwriter
* 34 = zip

SquirrelMail-specific information:
Version: 1.4.16
Plugins (List)
* 0 = abook_group
* 1 = abook_take
* 2 = bookmarks
* 3 = bug_report
* 4 = calendar
* 5 = compatibility
* 6 = delete_move_next
* 7 =
* 8 =
* 9 = html_mail
* 10 = listcommands
* 11 = vlogin
* 12 = login_auto
* 13 = mail_fetch
* 14 = message_details
* 15 = msg_flags
* 16 = newmail
* 17 = notes
* 18 = preview_pane
* 19 = sent_subfolders
* 20 = show_user_and_ip
* 21 = smallcal
* 22 =
* 23 = squirrelspell
* 24 =
* 25 = todo
* 26 = translate
* 27 = view_as_html
* 28 =
* 29 = calendar_sql_backend
* 30 =
* 31 = restrict_senders
* 32 = amavisnewsql
* 33 = postfixadmin
* 34 = lockout
* 35 = unsafe_image_rules

My IMAP server information:
Server type: courier
Server info: * OK [HIDDEN] IMAP4rev1 UIDPLUS CHILDREN NAMESPACE
THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION
STARTTLS] Courier-IMAP ready. Copyright 1998-2008 Double Precision, Inc.
See COPYING for distribution information.
Capabilities: IMAP4rev1 UIDPLUS CHILDREN NAMESPACE
THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION
STARTTLS

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Upgrade to PHP 5.3, sqmail 1.5.2 svn is stuck in a login loop.

2009-11-01T01:14:45Z

On Sun, Nov 1, 2009 at 1:12 AM, Paul Lesniewski <paul@...> wrote:

> On Wed, Oct 21, 2009 at 12:46 PM, Paul Lesniewski <paul@...> wrote:
>> On Tue, Oct 20, 2009 at 1:53 PM, David C. Rankin
>> <drankinatty@...> wrote:
>>> On Tuesday 20 October 2009 02:55:27 pm Paul Lesniewski wrote:
>>> <snip>
>>>>
>>>> It's been reported that 1.5.2 does this when using PHP 5.3. I have no
>>>> idea what versions the OP was using, but this is likely your problem.
>>>> I haven't had the time to test this, but you should first make sure
>>>> you are getting the right cookies set in the browser (please show
>>>> them). Also, please indicate what session storage mechanism you are
>>>> using.
>>>
>>> Ahah! Now we are getting somewhere. I have php 5.3.1, fresh update from 5.2.11
>>> at the same time the problems with sqmail begin. I have installed the new
>>> php.ini and done a line-by-line comparison and we are fine. Of particular
>>> interest here, open_basedir is NOT set so the include limitation problem isn't
>>> what is biting us.
>>>
>>> Cookies huh? Well I can find them in the browser, but I'm now sure where to
>>> look in sqmail. When I find them in the browser, I'll grep though sqmail and
>>> see what turns up....
>>
>> Cookies are in different places for different browsers. Any search
>> engine will help you locate them. For Firefox, you can look in
>> Tools->Options->Privacy for a way to see cookies. Please only show
>> the cookies that are under the location from where you view your
>> webmail.
>
> Turns out the problem is not really anything to do with sessions; it's
> a more strict use of NULL, wherein it cannot any longer be used as a
> placeholder for an empty array. The problem is fixed in SVN (revision
> 13870).

Thanks to David for kindly lending his resources to track the problem down.

>>> OK, let me preface this with the fact that I have less than a thimble full of
>>> knowledge about cookies. What I have come up with is snapshots of all of the
>>> cookies from both opera and firefox. The cookies I have captured are:
>>>
>>> ff_key.jpg
>>> ff_last_domain.jpg
>>> ff_last_login.jpg
>>> ff_PHPSESSID.jpg
>>> ff_SQMSESSID.jpg
>>> ff_squirrelmail_language.jpg
>>> ff_utma.jpg
>>> opera_utma.jpg
>>> opera_utmc.jpg
>>> opera_utmz.jpg
>>>
>>> Let me know which ones you want and I'll send them to you in a private post.
>>> Also, if you want me to create you an account on my server, I don't mind. That
>>> way you can ssh into the box and see what the issue is.
>>>
>>>
>>>> You can try, for example, commenting out the session_regenerate_id()
>>>> call on line 87 of src/redirect.php, but I have no idea if that's got
>>>> anything to do with the problem.
>>>>
>>>
>>> 85 sqsession_is_active();
>>> 86 if (function_exists('session_regenerate_id')) {
>>> 87 /* session_regenerate_id(); */
>>> 88 }
>>>
>>> No change:
>>> ERROR
>>> You must be logged in to access this page.
>>> Go to the login page
>>>
>>> <snip>
>>>
>>> Let me know where to get the cookie info from squirrelmail and I'll get that
>>> for you too. Also, I'm serious about the account. I worked with a number of
>>> opensource projects that way and never had a problem....

--
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Upgrade to PHP 5.3, sqmail 1.5.2 svn is stuck in a login loop.

2009-11-01T01:12:07Z

On Wed, Oct 21, 2009 at 12:46 PM, Paul Lesniewski <paul@...> wrote:

> On Tue, Oct 20, 2009 at 1:53 PM, David C. Rankin
> <drankinatty@...> wrote:
>> On Tuesday 20 October 2009 02:55:27 pm Paul Lesniewski wrote:
>> <snip>
>>>
>>> It's been reported that 1.5.2 does this when using PHP 5.3. I have no
>>> idea what versions the OP was using, but this is likely your problem.
>>> I haven't had the time to test this, but you should first make sure
>>> you are getting the right cookies set in the browser (please show
>>> them). Also, please indicate what session storage mechanism you are
>>> using.
>>
>> Ahah! Now we are getting somewhere. I have php 5.3.1, fresh update from 5.2.11
>> at the same time the problems with sqmail begin. I have installed the new
>> php.ini and done a line-by-line comparison and we are fine. Of particular
>> interest here, open_basedir is NOT set so the include limitation problem isn't
>> what is biting us.
>>
>> Cookies huh? Well I can find them in the browser, but I'm now sure where to
>> look in sqmail. When I find them in the browser, I'll grep though sqmail and
>> see what turns up....
>
> Cookies are in different places for different browsers. Any search
> engine will help you locate them. For Firefox, you can look in
> Tools->Options->Privacy for a way to see cookies. Please only show
> the cookies that are under the location from where you view your
> webmail.

Turns out the problem is not really anything to do with sessions; it's
a more strict use of NULL, wherein it cannot any longer be used as a
placeholder for an empty array. The problem is fixed in SVN (revision
13870).

>> OK, let me preface this with the fact that I have less than a thimble full of
>> knowledge about cookies. What I have come up with is snapshots of all of the
>> cookies from both opera and firefox. The cookies I have captured are:
>>
>> ff_key.jpg
>> ff_last_domain.jpg
>> ff_last_login.jpg
>> ff_PHPSESSID.jpg
>> ff_SQMSESSID.jpg
>> ff_squirrelmail_language.jpg
>> ff_utma.jpg
>> opera_utma.jpg
>> opera_utmc.jpg
>> opera_utmz.jpg
>>
>> Let me know which ones you want and I'll send them to you in a private post.
>> Also, if you want me to create you an account on my server, I don't mind. That
>> way you can ssh into the box and see what the issue is.
>>
>>
>>> You can try, for example, commenting out the session_regenerate_id()
>>> call on line 87 of src/redirect.php, but I have no idea if that's got
>>> anything to do with the problem.
>>>
>>
>> 85 sqsession_is_active();
>> 86 if (function_exists('session_regenerate_id')) {
>> 87 /* session_regenerate_id(); */
>> 88 }
>>
>> No change:
>> ERROR
>> You must be logged in to access this page.
>> Go to the login page
>>
>> <snip>
>>
>> Let me know where to get the cookie info from squirrelmail and I'll get that
>> for you too. Also, I'm serious about the account. I worked with a number of
>> opensource projects that way and never had a problem....

--
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Forcing a logout (invalidating current session)

2009-10-30T21:13:43Z

On Fri, Oct 30, 2009 at 2:07 PM, Andrew Daviel <advax@...> wrote:
>
> We had a user account compromised somehow (bad guys got the password).
>
> The user has changed their password.
> How can I kick off any logged-in sessions and make sure they can't login
> without knowing the new password ?

As others have suggested, restart imapproxy if you use it and grep for
PHP session files with the username in them and delete those. That's
probably the least intrusive (to any other users) method.

> I zapped the security tokes in user prefs (seemed like a good idea)
>
> BTW, interesting spammer technique - replaced the squirrelmail signature
> with the message, then sent empty messages)

You can (could have) stopped this almost right away with MTA
rate-limiting or by using the Restrict Senders plugin. The Squirrel
Logger plugin could also have alerted you to the problem. If the
attacker got the password by guessing on the login page, you can use
the Lockout and/or CAPTCHA plugins to block such attempts.

--
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Forcing a logout (invalidating current session)

2009-10-30T17:44:41Z

On Fri, 30 Oct 2009, Tomas Kuliavas wrote:

> Spammer will be kicked out, if he or she tries to open any page with imap
> authentication. Left folder listing, mailbox listing, message display or
> sending message and saving it in Sent folder will destroy session.

unless they use imapproxy, which a great deal do.

--
Res

"What does Windows have that Linux doesn't?" - One hell of a lot of bugs!

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users

Re: Forcing a logout (invalidating current session)

2009-10-30T12:13:37Z

Andrew Daviel-3 wrote:

We had a user account compromised somehow (bad guys got the password).

The user has changed their password.
How can I kick off any logged-in sessions and make sure they can't login
without knowing the new password ?

Spammer will be kicked out, if he or she tries to open any page with imap authentication. Left folder listing, mailbox listing, message display or sending message and saving it in Sent folder will destroy session.

If you want to be sure, find old PHP session files with compromised username and delete them.

--
Tomas

Forcing a logout (invalidating current session)

2009-10-30T11:07:32Z

We had a user account compromised somehow (bad guys got the password).

The user has changed their password.
How can I kick off any logged-in sessions and make sure they can't login
without knowing the new password ?

I zapped the security tokes in user prefs (seemed like a good idea)

BTW, interesting spammer technique - replaced the squirrelmail signature
with the message, then sent empty messages)

--
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376 (Pacific Time)
Network Security Manager

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
-----
squirrelmail-users mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-users@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.user
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users