IMAP server questions

gianh · 11-01-2008, 09:22 AM

Hi I was put in charge of an old fedora core 1 server. The server is running IMAP among other services, my question is how do i tell what server software is in charge of IMAP (dovecot,courier,etc....) also I have had complaints that hidden files and folders are shoing up in the mail clients that use imap folders like .bashrc,etc......

any help would be greatly appreciated

Thanks

bmarx · 11-01-2008, 01:51 PM

The -p of netstat will show you the pid and name of the program to which each socket belongs.

netstat -apn|grep 143

gianh · 11-01-2008, 03:55 PM

Thank you so much.

It states imapd.

I really appreciate it.

estabroo · 11-01-2008, 06:17 PM

telnet to port 143 and see if it gives you a banner

gianh · 11-02-2008, 01:18 PM

Ok it states IMAP4rev1 2003.338rh which i have never heard of and its not in the init.d scripts to stop or start.

estabroo · 11-02-2008, 01:33 PM

do rpm -qa | grep imap
From that banner I'm guessing uw-imap is installed.

gianh · 11-02-2008, 02:34 PM

imap-2002d-3.2.legacy

is returned

estabroo · 11-02-2008, 03:08 PM

I still believe that it is uw-imap (uw in this case is University of Washington). Security focus has a reference to that rpm in conjuction with UW.

http://www.securityfocus.com/bid/15009/solution

gianh · 11-02-2008, 04:28 PM

Thats exactly what it is, but it does not have a script to start and stop in init.d

how would i start and stop?

unSpawn · 11-02-2008, 04:39 PM

Quote:

Originally Posted by estabroo

Securityfocus has a reference to that rpm in conjuction with UW.

Kinda correlates with the OP:

Quote:

Originally Posted by gianh

(..) old fedora core 1 server. (..) among other services, (..) complaints (..) hidden files and folders

Maybe some checks should be run. Like those in the CERT Intruder Detection Checklist and preferably booted from a Live CD like KNOPPIX or HELIX (doesn't apply to colo boxen unless you got some cooperation).

gianh · 11-03-2008, 07:28 PM

ANy ideas how i can stop it and replace it with dove cot and the hidden files appear in mail clients like .bashrc etc.... are waht i meant by hidden files

unSpawn · 11-04-2008, 03:31 PM

As far as UW-IMAP is concerned it uses ~/.mailboxlist files to list mailboxes. Only having the "real" ones listed could fix things. Now I do understand your concerns for fixing things, but I think the Priority One issue here is that FC1 is obsolete. It's not only blisteringly outdated but could also contain kernel and software versions that are vulnerable to local or remote attacks. Please consider moving to a supported platform before tweaking things and putting everything else on the backburner.

gianh · 11-04-2008, 08:49 PM

Cool thanks guys for all your help.