232125 - add an option to skip some auth. methods to work around a problem with misconfigured POP3 server( "server does not accept proxy authentication command")

Status: RESOLVED WONTFIX

(MailNews Core :: Networking: POP, enhancement)

Description

[Park Jinuk]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113

When I connect pop3://nate.com , (It based www.nate.com, it is only korean
page), received only [ Sending of password did not succeed. Mail server nate.com
responded: server does not accept proxy authentication command ]. 
but I don't use proxy ( I know, maybe it use ISP?).
When I exam telnet connection port 110, I can read list.

Reproducible: Always

Steps to Reproduce:
1. Add account [nate.com]
2. Click Get new messages, and Input my password.
3. Received error message. see details or summary.

Actual Results:  
Cannot recevied anything.

Expected Results:  
nothing.

WXP Home KR, IBM R40 2681C7K, Home high-speed network.

Comment 1

[Matthias Versen [:Matti]]

Please provide a pop3 log :
http://www.mozilla.org/quality/mailnews/mail-troubleshoot.html

Comment 2

[Park Jinuk]

Attachment: nate.com pop-3 access log

It check many other encycript auth... what means?
I can access only user and pass.

Comment 3

[Park Jinuk]

Comment on attachment 139954 [details]
nate.com pop-3 access log

Ah.... before [ 0[2d3eb0]: Entering NET_ProcessPop3 101 ] is other mail
service. don't mind it.

Comment 4

[Matthias Versen [:Matti]]

Do you have some non-ASCII characters in your username or password ?
(cc [e-mail] for help)

Comment 5

[Park Jinuk]

No, I use only ASCII alphabet and number.

Comment 6

[Christian Eyrich]

Park, besides the plain text USER/PASS login mechanism some other authentication
mechanisms exist. Your server supports PLAIN, CRAM-MD5 and DIGEST-MD5.
We know the first two of them and start trying with the most secure (PLAIN in
this case, CRAM-MD5 if you check "use secure authentication" in the server
config) and fall back to a less secure (USER/PASS in this case).

Your server makes it impossible for us to fall back to USER/PASS and try it this
way because it disconnects after a "wrong login" what is very bad behaviour.

While I know many servers with wrong configurated CRAM-MD5 authentication it's
new to me to see a wrong configured PLAIN authentication.
Unfortunately the user can't force Mozilla to use USER/PASS only. But I suggest
you to check "use secure authentication" and try again.

Comment 7

[Park Jinuk]

Attachment: Log with "Security authentication"

I was it, but I cannot receive list. ... I don't know what can I doing.

Comment 8

[Park Jinuk]

I want fix it, and change my password and open here.

user dhunter
pass formozdev

It doesn't serve SMTP, and I think ,any trouble makes.

It only able Jan.

I want your fix~

Comment 9

[Christian Eyrich]

Ok, now after a few general problems with the PW, I managed it to log in the
server with USER/PASS.
This works via telnet, KMail, The Bat and Mozilla (modified to only use USER/PASS).
But the server doesn't work with PLAIN, CRAM-MDR, DIGEST-MD5 or APOP using any
program (or telnet).

That's a clear evidence for a misconfigured/malfunctioning server.
But it's another incident that should make us think about options to
enable/disable specific mechanisms by the user.

Comment 10

[Jungshik Shin]

I got the following greeting from mail.nate.com.


+OK POP3 server ready (7.0.024)
<[e-mail]>

The versioning scheme seems to be that of Microsoft, but I'm not sure. Without
the ID of the POP3 server, it's all but impossible to advise the server
administrator as to how to fix the problem in the server....

I'm changing this bug to an enhencement request.

Comment 11

[Christian Eyrich]

When using option to allow/disallow authentication mechanisms the best would be
an or'able bitfield like internally used
(http://lxr.mozilla.org/seamonkey/source/mailnews/local/src/nsPop3Protocol.h#103
ff.)
That's not easy to use when setting a pref manually, but IMHO the only choice
when we want to be able to allow some mechanisms while disallow another, i.e.
not only one at the same time.

My standpoint is that server problems should be solved by the server admin, so I
don't want to have a UI. That would lead to 1. people getting confused and 2.
they could bypass the problem to fast before contacting the admin.

Comment 12

[Jungshik Shin]

I don't think we need to add UI here. Just adding a backend pref. entry would be
sufficient if we ever decide to 'fix' this bug on our side. Either A or B would
work.

A. add boolean pref. entries as following: 
mail.pop3_auth.plain 
mail.pop3_auth.userpass
mail.pop3_auth.md5cram 

B. 
mail.pop3_auth_methods: a list of strings

Those unlucky users of broken POP3 servers can turn off all but userpass. 

Comment 13

[(not reading, please use [e-mail] instead)]

sorry for the spam.  making bugzilla reflect reality as I'm not working on these bugs.  filter on FOOBARCHEESE to remove these in bulk.

Comment 14

[Serge Gautherie (:sgautherie)]

Filter on "Nobody_NScomTLD_20080620"

Comment 15

[Max Emig [:maxe]]

We have an entirely new POP3 implementation by now and generally tighter security requirements on both sides.