lfwmail is a light weight web mail program written in perl. 
It will run with acceptable speed even on a Pentium 100Mhz Linux mailserver.
It has just basic features and no calendar or folders but it is fully 
mime compatible and can handle attachments.

If you are a "browser cookie hater" then you will like this program 
too because you can use it even without cookies enabled.

It is also very secure when you use https (encryption). HTML
mails are converted to ascii test for security reasons but
you can still see the html mail if you want.

The code is clean and structured. Installation is straigt forward
and you don't need a lot of non standard modules.

You can run it in mod_perl if you want. However I don't recommend
it at this moment (version 0.6). There are still some config variables
which don't harm as they don't change but I have to clean them up.

Download/Copyright:
-------------------
Copyright: GPL, Author: Guido Socher (guido(at)linuxfocus.org)
homepage: http://linuxfocus.org/~guido/

History:
--------
I wanted to install a light weight webmail program on my server
which would not require php as php it self is very resource demanding.
Looking around the net I found many solutions and I started to
test the one by one. Most of them were quite fat. Those which looked
more basic where often quite complex to install or had rather unreadable
code. When I accidentially found that one of those webmail programs allowed
me to execute arbitary code by using a carefully written mail I decided:
This is enough. I write my own application. 

Installation:
-------------

1) install the needed Perl modules as listed below. 
2) go to the test directory and execute
   poptest username password 
   to verify that pop3 access and the Mail::POP3Client installation
   works
3) Run 
   mimeparsetst test
   to check that MIME::Parser installation is OK

4) copy lfwmail lfwmail_display and lfwmail_send to the cgi-bin
   directory of your web server. Edit them and change the line
   use lib '/home/webmail/lfwmail';
   to point to a directory where lfwmC.pm configuration file will be.

5) copy the file lfwmC.pm to the directory you have specified in the
   "use lib" statement under point 4

6) edit the configuration parameters in the function getconfig

7) enjoy

Needed perl modules:
--------------------
You need only 3 non standard perl modules (modules which are normally
not part of the base installation of perl):

Mail::POP3Client (from authors/id/S/SD/SDOWD/POP3Client-.....tar.gz)
MIME::Parser (from authors/id/E/ER/ERYQ/MIME-tools-.....tar.gz)
MIME::Lite (from authors/id/E/ER/ERYQ/MIME-Lite-.....tar.gz)

Unfortunatley these 2 out of these 3 have their own requirements on other
perl modules which you need to install first. You can test if you have
one of them already installed by running the command
perl -e 'use NameOftheModule;'
If this returns nothing then the modules is installed otherwise you will
get and error.
Example: perl -e 'use MD5;'

Perl modules are installed with the usual:
perl Makefile.PL
make
make test
make install

You can also use the perl -MCPAN -e shell; command to install it.

Mail::POP3Client needs:
authors/id/G/GA/GAAS/MD5-2.02.tar.gz

MIME::Parser needs:
 File::Path       usually already installed
 File::Spec       from authors/id/R/RB/RBS/File-Spec-.....tar.gz
 IPC::Open2       usually already installed
 IO::Scalar       from authors/id/E/ER/ERYQ/IO-stringy-.....tar.gz
 MIME::Base64     from authors/id/G/GA/GAAS/MIME-Base64-.....tar.gz
 Net::SMTP        from authors/id/G/GB/GBARR/libnet-.....tar.gz
 Mail::Internet   from authors/id/M/MA/MARKOV/MailTools-.....tar.gz


Pop3 security considerations
---------------------------
If you don't want to allow pop3 access from outside and use
the pop3 daemon only internally on the same server where lfwmail is
running then add a only_from line to the /etc/xinetd.d/ipop3 (linux):

service pop3
{
        socket_type             = stream
        wait                    = no
        user                    = root
        server                  = /usr/sbin/ipop3d
        log_on_success          += USERID
        log_on_failure          += USERID
        disable                 = no
        only_from               = 127.0.0.1
}

Exposure of user IDs and passwords
----------------------------------
Password and user ID are sent in clear text when you login. Later only
a security cookie (not a browser cookie) is passed around. This cookie
has limited life time.  If you don't want to expose the passwords at
login time then you should use https encryption.

lfwmail has also a "shadow user" security feature which limits the risk
in case you don't want to use encryption:  It is one thing that
somebody gets hold of your password and user ID to read your mail. It
is however yet another thing if he can use this password to login to
your server. You might accept the risk that somebody can read the mail
but you don't want him to login to the server. Those users who can
login to the server (if you have disabled login then this is not an
issue) should get a second account where shell login is disabled. This
second account is used for mail. You forward all email from the primary
account to the second account (.forward file) . When you read mail via
lfwmail then you use the second (login disabled) account. You set the
configuration variable "shadowuid" such that all mail that you send out
will appear as if it came from the primary account.  Example: uid=joe
mailuid=joe_wm -> set shadowuid (in lfwmC.pm) to '_wm$'.  You use
joe_wm to login to your email but it will look as if you sent it from
joe. The password for uid=joe is therefore never exposed to the net.

Software structure:
-------------------
The code is devided into 3 scripts which different functions.
This is to optimize code volume and reduce compile time for
the perl interpreter.

lfwmail -> takes care login process, list the inbox, delete messages
lfwmail_display -> dispaly messages and decode messages. Messages are
                   decoded only once per session. The mime parser is
                   not executed when you click a second time on a message.
                   The temporary decoded files are deleted at logout (or
                   at the next login if it did not happen at logout).
lfwmail_send -> compose messages. For forwareded or replied messages this
                module relies on lfwmail_display to do the decoding first.
                This is however always the case as you must first click on
                the message before you can forward or reply.

Versions:
---------

Fri Mar 21 22:12:25 CET 2003: version 0.5: 
  first public version
Mon Mar 31 19:52:27 MET DST 2003: version 0.6: 
  changes in all files including lfwmC.pm 
  bug fixes:
   - missing date in message list
   - authentication error when zero messages in mail box
   - more mime types for uploaded attachements
   - double header in case of forward
   - faults in html code
                                         
# vim: set sw=4 ts=4 si et:
