alpine with .pine-passfile support

[slowtechstef]

For several reasons I really enjoy using alpine as a mail client. I know most people use mutt, however I myself like the sane defaults of alpine. I did try mutt, but just kept reconfiguring the program.

I just discovered that on OpenBSD 5.8 (arch i386) when you install alpine as a package there is no support compiled in for .pine-passfile so the program keeps asking your password every time you open your inbox or send an e-mail.

Both the manpage of alpine and "alpine -supported" both do not show the .pine-pass option. So I guess it just not compiled in.

Is there a specific reason to not use a .pine-passfile? Is this really bad behaviour security-wise?

I use alpine only for my gmail account with IMAP access, and then use it with an application specific password that is tied explicitly to that program on that specific computer.

So I guess if I would like to use alpine with .pine-passfile support I should install it from ports? I ask this because compiling programs from ports is something I am not quite sure if I am ready to do that. Also the FAQ encourages users to install packages if possible.

Or is there another easy solution I just overlooked?

[ocicat]

Originally Posted by slowtechstef

Or is there another easy solution I just overlooked?

Perhaps someone with experience/knowledge of mail/alpine will respond, but in case not, the next step would be to contact the maintainer of the port.

Unfortunately, there is no designated maintainer. The next step would be to post to the official ports@ mailing list. Information on subscribing can be found at the following address:

http://www.openbsd.org/mail.html

[J65nko]

At this moment the developers are in "release" mode

You could look at the Makefile of the the alpine port and check whether there is such an option that you can enable.

BTW I always install alpine to read the system mail, but there I don't need a password

[jggimi]

I don't know anything about alpine. But I did look through the source and noted that if you run the GNU configure script with the option --with-passfile=FILENAME you will get a warning that states, "--with-passfile definition overrides OS-Specific password caching".

This option is not among those included among those in the port's Makefile $CONFIGURE_ARGS variable. Could it be added? Sure. Will it fail to build, or fail to operate properly? It might. Adding the option would require testing.

----

Looking through the history of comments on the ports@ mailing list, I found this comment from 15 years ago:

In order for you to have pine log in without a password, it needs to use rsh or ssh with RSA/DSA authentication, or you compile it with the PASSFILE option...

My guess is that an ssh(1) session might be used, perhaps with a passphrase stored once by ssh-agent(1). ssh-agent() is currently the only "password caching" tool in the base OpenBSD system. It doesn't really do that. It caches private keys used in with public key authentication, so that a user is only prompted for a private key passphrase once.

The history of the port (in ports@ archives) indicates that the PASSFILE option was once proposed, but rejected along with other added options as too large a change at the time. It was never implemented.