In this document:
It is possible to configure SqWebMail to transmit the userid and password via secure HTTP. If secure HTTP is not available, the userid and password is transmitted over the network in the clear, which can be picked up by a sniffer. SqWebMail supports an alternate password which is stored in a file in the Maildir directory. The file has read and write permissions to the user only. If the alternate password is compromised, only SqWebMail recognizes it, and only access to the private mail will be available. Access to the main account will not be compromised, if the account password is different.
Technically, the mailboxid that's generated by recent versions of sqwebmail are of the form "userid.method", where method represents the authentication module that was used.
A mailboxid is sent with every HTTP request, in the request itself. Note that the mailboxid is transmitted over the network in the clear. It is also possible to use secure HTTP for the every HTTP request, not just initial authentication, but this has not been tested.
Unless the mailboxid is the same as a userid, there aren't many security considerations in having the mailboxid broadcasted over the network. That's because the mailboxid in the HTTP request is usually validated based on a time-limited IP address (see "Authentication"). Note that there certain other potential ways - in addition to network traffic sniffing - for an unauthorized party to attempt to grab mailboxids. See "Browser Security - HTML", and "Browser Security - Referrer: Tags".
By default, SqWebMail permits access to the mailbox only from the same IP address as the one where the user ID and password was authenticated from. This can be selectively turned off at login time, in cases where the client is behind a load-balancing firewall that uses multiple IP addresses. In all cases, a 128-bit random number must be transmitted with every HTTP request, and it must match the number generated during the login, which is saved in the Maildir directory.
The Maildir directory must therefore have any group or world access rights disabled. Additionally, every page served by SqWebMail includes HTTP headers containing instructions to proxies and browsers that prohibit this page from being cached. There are some buggy web browsers out there - most of them originating in Redmond,WA - that ignore these caching directives, and they end up saving the 128-bit random number in the local cache. Unless access to the physical machine is secured, the local cache can be trawled to obtain the 128-bit authentication token.
However, access to the mailbox is allowed only for a maximum period of time after the initial authentication. Access is allowed only if the HTTP requests come within a different, shorter period of time. If no access requests have been made for a certain period of time, access will no longer be available even if it comes from the right IP address, with the right authentication token.
The IP address of the initial authentication, the dates and times involved, are all stored in files in the maildir directory, with group and world permissions turned off.
SqWebMail uses a frame window in an attempt to keep the browser from recording visited URLs. This approach works for most popular web browsers that support frames - these browsers do not maintain history for individual frames. Note that frames are not required to access the full SqWebMail functionality.
SqWebMail depends on the mail server to read the headers for recipients and to strip out the Bcc: header. SqWebMail uses the black-box authentication module to set the contents of the From: header and provide the envelope return address.
The IP address of the HTTP client is not inserted into the headers, however
the wrapper and the mail server are invoked under the userid of an
authenticated user. The wrapper shell script can be modified to insert the IP
address, if so desired. The wrapper shell script has access to the CGI
REMOTE_ADDR environment variable.
SqWebMail is invoked by the web server to handle each HTTP request. SqWebMail must assume permissions of the mail client in order to be able to access its mailbox. Additionally, SqWebMail must be able to authenticate access passwords. For both of these reasons SqWebMail has to be installed as a setuid root program.
When virtual mailboxes are being used, it is possible to install SqWebMail setuided to the virtual userid, instead of root. For that to work, each account's Maildir must be created with the account password already saved in Maildir/sqwebmail-webpass file, or a virtual domain mechanism like vchkpw must be used.
On some platforms this may not work without some additional tweaking. If authenticating with sqwebmail setuided to the virtual userid doesn't work:
void authchangegroup() {} void authchangeuidgid() {} void authchangeusername() {}
Immediately upon starting, SqWebMail's activity as root is as follows: