Subject: Re: newbie pop3 and DNS

From: [email-masked]
Date: Wed, 1 Mar 2000 20:14:02 +0300

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

APOP is md5-based challenge/responce authentication protocol.
It is based on md5 of password combined with session-unical timestamp.
Not a bad solution, what's wrong with it?

                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

From: "Matthew P. Barnson" <[email-masked]>
Date: Tue, 7 Mar 2000 21:11:08 -0700

It is extremely common for ISP's to use tcp_wrappers to secure POP3
connections.  We use it here, and it's pretty effective.
One of the most effective solutions we've found to passing passwords in
cleartext across the Internet involves either the use of a hardware VPN
solution, or SSH to tunnel the connection, like this:
ssh -C -L 4110:localhost:110 remote.host.domain.com
Then you set up your plug to POP the mail through "localhost:4110" and voila!
you're running your POP3 requests over an encrypted tunnel.  This is, of course,
assuming the host from whom you're popping the mail allows you to connect via
SSH.  If they don't, encourage them to.

SSH port forwarding is a complicated subject, but once you've mastered how it
works it's an extremely powerful tool for encrypting what you'd rather not have
in the clear.

-- 

Matthew P. Barnson 	     [email-masked]	
Mgr,Systems Administration   Excite@Home E-business Services

---

From: Blair Lowe <[email-masked]>
Date: Wed, 8 Mar 2000 11:25:38 -0700

Sounds cool.

But I am not sure I understand the meaning of:

>"assuming the host from whom
>you're popping the mail allows you to connect via
>SSH"

host do you refer to? the ISP client's host? If so does a pop client 
need a special MUA (Mail user agent) to read his email?

I suppose an ASCII diagram of a typical set-up would make things clearer to me.

Blair

>works it's an extremely powerful tool for encrypting what you'd 

Computer Engineering Inc.
http://www.compeng.net
Phone: 780 499 5687 (9 - 5 MST)
Fax:   780 435 0693 (24 Hours)