FAQ for Qpopper

What is the latest version of Qpopper and where can I get it?
Is there a mailing list for Qpopper?
Which versions of Qpopper are vulnerable to remote exploit?
No NDBM on my Workstation?
Can you make Qpopper look for passwords in a file other than /etc/passwd?
I get the message "-ERR system error, can't open temporary file. Do you own it?"
What is the purpose of SERVER_MODE?
How do I invoke Bulletin services?
Does Qpopper support secure authentication?
What is APOP authentication?
How do I setup APOP authorization?
Is Qpopper Y2K Compliant?
What does the warning "Possible probe of user account x from host y" mean?
What does the message "pop3/tcp server failing (looping), service terminated" mean?
Can I use Qpopper over NFS?
What does the error message "Unable to get canonical name of client" mean?
What does the error message "Unable to copy mail spool file to temp pop dropbox" mean?
What does the error message "Unable to process From lines (envelope), change recognition modes" mean?



What is the latest version of Qpopper and where can I get it?
The latest released version of Qpopper is 2.53. We also encourage you to try version 3.0, which is currently in beta. You can get Qpopper from Qualcomm's FTP site at ftp.qualcomm.com/eudora/servers/unix/qpopper/. If you are outside the U.S., you might want to try one of the mirror sites. See eudora.qualcomm.com/free/servers.html for a list.

Is there a mailing list for Qpopper?
There is a public mailing list for discussion of Qpopper. Qpopper administrators are encouraged to join. To subscribe, send the word "subscribe" (without the quotes) as the body of a message to qpopper-request@lists.pensive.org or if your browser supports it and is configured so this works, click here.

Which versions of Qpopper are vulnerable to remote exploit?
Qpopper2.41 and prior versions are vulnerable to buffer overflow. Remote users can obtain root access on systems running these versions. Releases of Qpopper 2.5 and later are immune from all known buffer overrun security holes posted in bugtraq. Please upgrade your server if you are running any Qpopper older than 2.5.

No NDBM on my Workstation?
NDBM is a database Manager utility that is optionally available with most UNIX installations. GDBM is another database Manager by GNU. If you don't have an NDBM library, use the GDBM library by defining the macro GDBM in the make file for your installation. Also, link with the appropriate library which is -lgdbm for GDBM.
Database Manager is used for APOP and bulletins.

Can you make Qpopper look for passwords in a file other than /etc/passwd?
No. Since the Qpopper reads from the mail spool of the UNIX user, you need to go through the UNIX authentication mechanism.

I get the message "-ERR system error, can't open temporary file. Do you own it?"
This occurs when the user does not have the permissions to create the temporary drop in the mail spool directory. Check the permissions of the spool directory. Qpopper creates the temporary file .user.pop in the mail spool directory.

What is the purpose of SERVER_MODE?
SERVER_MODE makes an assumption that only /bin/mail is being used as a Delivery agent. In which case, incoming mail is appended to the mail spool. This is permissible because the processes see exclusive regions in the spool file.
Server Mode reduces I/O on transactions
In other words, transactions that delete All or None of the messages.
In normal mode, the mail spool is copied into a temporary file at the beginning of the transaction. Once the transaction is complete, the undeleted messages are copied back to the mail spool. For example, a user has a 4M spool file and checks for mail every minute increases I/O overhead.

Does Qpopper support secure authentication?
Authentication mechanisms supported by Qpopper are user/pass, APOP and Kerberos. Currently, Qpopper does not support authentication using AUTH command. To minimize the damage of using a clear text password over the network, use APOP authentication. If you have a Kerberos engine, it serves the purpose.

What is APOP authentication?
With APOP, MD5 fingerprints are generated on a block of data that contain password and pid.clock@hostname. It is the fingerprint that is sent to the server for authentication. It makes your system more secure because pid and clock values differ on each connection, and an obscure password is sent. For details please refer RFC1460.

How do I invoke Bulletin services?
This can be done in two ways, 1)By defining the macro BULLDIR set to the path of bulletins. This enables bulletins by default, regardless of the command line options. The server will use .popbull file in the users home directory for the last bulletin read. The alternative for .popbull is to define BULLDB macro, refer INSTALL file with distribution. 2) Using the command line option -b bulldir. This will override the compiled value if it is defined.

How do I setup APOP authorization?
APOP is an alternate authentication method. It is able to authenticate without passing the password in cleartext over the wire. To enable this feature, you need to define the following compiler definitions:
APOP=\"/etc/pop.auth\"
POPUID=\"pop\"
The first definition is the location of the database; the second specifies the user/password entry that will own the authorization database. When you build the Qpopper with APOP, you also get a program called popauth which must be installed in a public location. This program must also run SUID as the 'pop' user so that it can make modifications to the pop.auth database.

NOTE: Make sure the database /etc/pop.auth is owned by POPUID and that the permissions are 600. popauth -init creates the file with the proper owner and perms.

The database must be initialized by root with the following command:
popauth -init
New users can be added by root or the 'pop' user with the following command:
popauth -user <user>
Or removed with the following command:
popauth -delete <user>
Any user on the host can add themselves or change their password with the following command:
popauth

Is Qpopper Y2K Compliant?
Yes it is. Qpopper is y2k compliant.

What does the warning "Possible probe of user account x from host y" mean?
This indicates a user or mail program issued a QUIT command in the middle of authenticating. While this may be perfectly normal, it can also indicate a possible break-in attempt, hence the warning. There is also a bug in some versions of Qpopper which erroneously treated this as a CRITICAL priority, instead of WARNING, resulting in the message being sent to all consoles and root users.

What does the message "pop3/tcp server failing (looping), service terminated" mean?
If you see the message "pop3/tcp server failing (looping), service terminated" in your log, it means that inetd received more requests for Qpopper service within one minute than it is configured to allow. On most systems, by default inetd only permits 40 connections within one minute to any service. If you have a lot of users, this may be too small a limit. You can increase the global default (for all inetd services) by passing a timeout argument to inetd. On most systems, you can increase the timeout for Qpopper by modifying your inetd.conf file. Find the pop3 line, and change "nowait" to "nowait.timeout", for example, "nowait.60" to permit 60 Qpopper connections within one minute.

Can I use Qpopper over NFS?
We recommend against using Qpopper over NFS. This is because of file locking issues. If you plan on exporting the mail spool and you trust the system's file locking then it may work for you. However, because we have had some complaints about the locking on NFS, we can not recommend doing this. If you decide to try it and are successful please let us know.

What does the error message "Unable to get canonical name of client" mean?
This error message in your log means that a client connected in and Qpopper got an error when it tried to do a reverse lookup on the IP address. If the client is local, this may indicate a problem with it's DNS entry (specifically the PTR record for that IP address), or it may be a temporary DNS problem. Qpopper 3.0 allows you to turn off this check if you like. Qpopper 3.0 includes the IP address of the client in the log message.

What does the error message "Unable to copy mail spool file to temp pop dropbox" mean?
You need to ensure that enough free space exists in your spool directory, and any user disk quotas are large enough, so that the spool file can be copied. This means at least twice the spool file size may be needed.

What does the error message "Unable to process From lines (envelope), change recognition modes" mean?
This indicates that the mailbox is corrupted; The first line. which should contain a "From " or MMDF separator is not recognizable. Edit the mail spool file and check the first line. If it is blank, delete it and any following blank lines until you see a separator. If the line starts with "from" or "FFrom", correct it to be "From ".