lfwmail is a light weight web mail program written in perl. 
It will run with acceptable speed even on a Pentium 100Mhz Linux mailserver.
It has just basic features and no calendar or folders but it is fully 
mime compatible and can handle attachments.

If you are a "browser cookie hater" then you will like this program 
too because you can use it even without cookies enabled.

It is also very secure when you use https (encryption). HTML
mails are converted to ascii test for security reasons but
you can still see the html mail if you want.

The code is clean and structured. Installation is straigt forward
and you don't need a lot of non standard modules.

You can run it in mod_perl if you want. Remember to restart the
server when you do changes in the lfwmC.pm or any other file.
Response time will be very fast with mod_perl however for most people
normal cgi-bin will be good enough. lfwmail is already quite fast.

lfwmail is a light weight mail program. It does not keep track on what
you have read and what is new. You have to remember the dates of the
mails. There is however a small help to keep track on what you have seen
and what is new. It works for Mozilla (not netscape 4), Opera and MS IE
only as it depends on javascript style objects: the bg color of e-mails
you have clicked on is changed. This is to keep track on what you have
read and what is new. This information does not survive between sessions.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Download/Copyright:
-------------------
Copyright: GPL, Author: Guido Socher (guido(at)linuxfocus.org)
homepage: http://linuxfocus.org/~guido/
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

History:
--------
I wanted to install a light weight webmail program on my server
which would not require php as php it self is very resource demanding.
Looking around the net I found many solutions and I started to
test the one by one. Most of them were quite fat. Those which looked
more basic where often quite complex to install or had rather unreadable
code. When I accidentially found that one of those webmail programs allowed
me to execute arbitary code by using a carefully written mail I decided:
This is enough. I write my own application. 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Installation:
-------------

1) install the needed Perl modules as listed below. 
2) go to the test directory and execute
   poptest username password 
   to verify that pop3 access and the Mail::POP3Client installation
   works
3) Run 
   mimeparsetst test
   to check that MIME::Parser installation is OK

4) copy lfwmail lfwmail_display and lfwmail_send to the cgi-bin
   directory of your web server. Edit them and change the line
   use lib '/home/webmail/lfwmail';
   to point to a directory where lfwmC.pm configuration file will be.

5) edit the configuration parameters in the function getconfig of the file
   lfwmC.pm

6) copy the file lfwmC.pm to the directory you have specified in the
   "use lib" statement under point 4

7) enjoy
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Needed perl modules:
--------------------
You need only 3 non standard perl modules (modules which are normally
not part of the base installation of perl):

Mail::POP3Client (from authors/id/S/SD/SDOWD/POP3Client-.....tar.gz)
MIME::Parser (from authors/id/E/ER/ERYQ/MIME-tools-.....tar.gz)
MIME::Lite (from authors/id/E/ER/ERYQ/MIME-Lite-.....tar.gz)

Unfortunatley these 2 out of these 3 have their own requirements on other
perl modules which you need to install first. You can test if you have
one of them already installed by running the command
perl -e 'use NameOftheModule;'
If this returns nothing then the modules is installed otherwise you will
get and error.
Example: perl -e 'use MD5;'

Perl modules are installed with the usual:
perl Makefile.PL
make
make test
make install

You can also use the perl -MCPAN -e shell; command to install it.

Mail::POP3Client needs:
authors/id/G/GA/GAAS/MD5-2.02.tar.gz

MIME::Parser needs:
 File::Path       usually already installed
 File::Spec       from authors/id/R/RB/RBS/File-Spec-.....tar.gz
 IPC::Open2       usually already installed
 IO::Scalar       from authors/id/E/ER/ERYQ/IO-stringy-.....tar.gz
 MIME::Base64     from authors/id/G/GA/GAAS/MIME-Base64-.....tar.gz
 Net::SMTP        from authors/id/G/GB/GBARR/libnet-.....tar.gz
 Mail::Internet   from authors/id/M/MA/MARKOV/MailTools-.....tar.gz
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=


Pop3 security considerations
---------------------------
If you don't want to allow pop3 access from outside and use
the pop3 daemon only internally on the same server where lfwmail is
running then add a only_from line to the /etc/xinetd.d/ipop3 (linux):

service pop3
{
        socket_type             = stream
        wait                    = no
        user                    = root
        server                  = /usr/sbin/ipop3d
        log_on_success          += USERID
        log_on_failure          += USERID
        disable                 = no
        only_from               = 127.0.0.1
}
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exposure of user IDs and passwords
----------------------------------
Password and user ID are sent in clear text when you login. Later only
a security cookie (not a browser cookie) is passed around. This cookie
has limited life time.  If you don't want to expose the passwords at
login time then you should use https encryption.

lfwmail has also a "shadow user" security feature which limits the risk
in case you don't want to use encryption:  It is one thing that
somebody gets hold of your password and user ID to read your mail. It
is however yet another thing if he can use this password to login to
your server. You might accept the risk that somebody can read the mail
but you don't want him to login to the server. Those users who can
login to the server (if you have disabled login then this is not an
issue) should get a second account where shell login is disabled. This
second account is used for mail. You forward all email from the primary
account to the second account (.forward file) . When you read mail via
lfwmail then you use the second (login disabled) account. You set the
configuration variable "shadowuid" such that all mail that you send out
will appear as if it came from the primary account.  Example: uid=joe
mailuid=joe_wm -> set shadowuid (in lfwmC.pm) to '_wm$'.  You use
joe_wm to login to your email but it will look as if you sent it from
joe. The password for uid=joe is therefore never exposed to the net.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Software structure:
-------------------
MIME::Lite is used to send out the mail. Normal sendmail is used for this
and the option -t is set to scan for cc and bcc fields.
This will work for postfix and the original sendmail.
Exim is more security aware and will not process cc and bcc unless you
set the trusted_users option. You need to set it to the process name
under which your webserver runs (normally trusted_users = apache)
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Software structure:
-------------------
The code is devided into 3 scripts which different functions.
This is to optimize code volume and reduce compile time for
the perl interpreter.

lfwmail -> takes care login process, list the inbox, delete messages
lfwmail_display -> dispaly messages and decode messages. Messages are
                   decoded only once per session. The mime parser is
                   not executed when you click a second time on a message.
                   The temporary decoded files are deleted at logout (or
                   at the next login if it did not happen at logout).
lfwmail_send -> compose messages. For forwareded or replied messages this
                module relies on lfwmail_display to do the decoding first.
                This is however always the case as you must first click on
                the message before you can forward or reply.

Inportant data structurs:
$cf (config data) set via the function lfwmC::getconfig(). Contains
all options that can be configured when you install lfwmail

$ud (user data). This data is related to the user who is just logged in.
Available fields are:
$ud{'cookie'}
$ud{'uid'}
$ud{'action'}

Action is split in the programs lfwmail_send and lfwmail_display into:
$ud->{'action'} (a one character saying what to do)
$ud->{'msgnum'} the number of the message that the action applies to

$ud->{'pw'} is available after calling lfwmC::cookie2pw or in
lfwmail after login.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Versions:
---------

Fri Mar 21 22:12:25 CET 2003: version 0.5: 
  first public version

Mon Mar 31 19:52:27 MET DST 2003: version 0.6: 
  changes in all files including lfwmC.pm 
  bug fixes:
   - missing date in message list
   - authentication error when zero messages in mail box
   - more mime types for uploaded attachements
   - double header in case of forward
   - faults in html code

Fri Apr  4 22:41:48 CEST 2003: version 0.7:
   - work now with mod_perl
                                         
Sun Apr 13 11:28:32 CEST 2003: version 0.8:
   - write a log file ("secretsdir/lfwmail.log")
   - bug fix: bcc field in send form did not work

Mon Apr 28 12:52:48 CEST 2003
   -Jacek Lipkowski (sq5bpf(Q)andra.com.pl)
   has reported that $pop->Connect() returns false 
   when using popa3d from http://www.openwall.com/popa3d
   Replaced $pop->Connect() with $pop->Alive()

   - for Mozilla (not netscape 4), Opera and MS IE: 
   the bg color of e-mails you have
   clicked on is changed. This is to keep track on what you have
   read and what is new. This information does not survive between
   sessions. It is implemented in javascript only

Thu May  1 21:05:53 CEST 2003
    - more readable layout

#
# vim: set sw=4 ts=4 si et:
