/* ========================================================================
 * Copyright 1988-2006 University of Washington
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * 
 * ========================================================================
 */

		       .imaprc secrets revealed!
		      Mark Crispin, June 17, 2002

The following information describes the format of the /etc/c-client.cf
and ~/.imaprc file.  The Columbia MM ~/.mminit file is also read by
c-client; however, the only command that ~/.mminit has in common is
set keywords.

**********************************************************************
*		     DANGER!  BEWARE!  TAKE CARE!		     *
**********************************************************************
*								     *
*  These files, and this documentation, are for internal UW usage    *
* only.  This capability is for UW experimental tinkering, and most  *
* emphatically *not* for sorcerer's apprentices at other sites who   *
* feel that if a config file capability exists, they must write a    *
* config file whether or not there is any need for one.		     *
*								     *
*  This information is subject to change without notice.  Commands   *
* may be added, removed, or altered.  The behavior of comamnds may   *
* change.  Do not use any of this information without consulting me  *
* first.  c-client's defaults have been carefully chosen to be right *
* for general-purpose and most special-purpose configurations.  If   *
* you tinker with these defaults, all hell may break loose.	     *
*								     *
*  This is not an idle threat.  There have been several instances of *
* people who ignored these warnings and have gotten burned.	     *
*								     *
*  Don't even trust this file to work.  Many of the things which can *
* be changed by this file can also be changed by the application,    *
* and it is totally unpredictable which will take precedence.  It    *
* all depends upon how the application is coded.  Not only that, you *
* may cause the application to crash.                                *
*								     *
*  In other words, keep your cotton-pickin' hands off my defaults.   *
* If it crashes and erases your mail, I don't want to hear about it. *
* Consider 'em ``mandatory defaults''.  Got a nice ring, eh?  :-) If *
* you must tinker with defaults, play with the .pinerc and pine.conf *
* files in Pine.  It's got options galore, all supported for you to  *
* have fun.  They're also documented; so well documented, it takes   *
* two strong men to carry around all the documentation.	 ;-) ;-)     *
*								     *
*  Joking aside, you really shouldn't be fooling around with this    *
* capability.  It's dangerous, and you can shoot yourself in the     *
* foot easily.  If you need custom changes, you are better off with  *
* local source code modifications.  Seriously.			     *
*								     *
*  One last warning: don't believe anything that you read in this    *
* document.  Every effort has been made to ensure that this document *
* is incomplete and inaccurate, and I take no responsibility for any *
* glimmers of correct information that may, by some fluke, be here.  *
*								     *
**********************************************************************

The files are read in order: /etc/c-client.cf, ~/.mminit, ~/.imaprc,
and an entry in a later file overrides the setting of an earlier file
except as noted below.  This ordering and overriding behavior may
change without notice.

Almost all of these facilities can also be set via the mail_parameters()
call in the program.  Whether the file overrides mail_parameters(), or
mail_parameters() overrides the file, is indeterminate.  It will vary
from program to program, and it may be one way in one version and the
other way in the next version.  It's completely unpredictable, and so
anything you do with these files has to be in complete knowledge of what
the version of each program you're running is going to do.  This is
because the files do something for testing, but the real capability for
configurability is put in the program instead.  Are you getting the
feeling that you shouldn't be messing with these files yet?

The very first line of the file MUST start with the exact string "I
accept the risk".  This ensures that you have checked the file for
correctness against this version of the IMAP toolkit.  This enable
string may change without notice in future versions, and the new
string may or may not be accurately described in an updated version of
this file.  So any time you install software that uses the IMAP
toolkit, you need to check the new version against these files (if you
have insisted upon creating them in spite of all warnings).  If two
pieces of software use different versions of the IMAP toolkit with
incompatible requirements, one of them won't work.  Re-read the
warning above about why you should not use these files.

Subsequent lines are read from the file one at a time.  Case does not
matter.  Unrecognized commands are ignored.

1) set new-folder-format
   sets what format new mailboxes are created in.  This also controls
   default delivery via tmail and dmail.

   a) set new-folder-format same-as-inbox
      Folder is created using the same mailbox format as INBOX.  If
      INBOX is empty, it defaults to system standard.

   b) set new-folder-format system-standard
      This is the default.  Folder is created using the wired-in system
      standard format, which on most UNIX systems is ordinary UNIX
      /bin/mail format.  On SCO systems, this is MMDF.

   c) set new-folder-format <driver name>
      Folder is created using the given driver name, e.g. mbx, unix,
      mmdf, etc.

   There is no protection against setting this to a silly value (e.g.
   news, nntp, dummy) and doing so is a great way to screw things up.
   Setting this to mh does not do what you think it does.  Setting this
   to tenex or mtx isn't particularly useful.

2) set empty-folder-format
   sets what format data is written into an empty mailbox file using
   mail_copy() or mail_append().  This also controls default delivery
   via tmail.

   a) set empty-folder-format same-as-inbox
      Data is written using the same mailbox format as INBOX.  If
      INBOX is empty, it defaults to system standard.

   b) set empty-folder-format system-standard
      This is the default.  Data is written using the wired-in system
      standard format, which on most UNIX systems is ordinary UNIX
      /bin/mail format.  On SCO systems, this is MMDF.

   c) set-empty-folder-format <driver name>
      Data is written using the given driver name, e.g. tenex, unix,
      mmdf, etc.

   There is no protection against setting this to a silly value (e.g.
   news, nntp, dummy) and doing so is a great way to screw things up.
   Setting this to mh, mbx, or mx does not work.

3) set keywords <word1>, <word2>, ... <wordn>
   Sets the list of keyword flags (supported by tenex and mtx) to the
   given list.  Up to 30 flags may be given.  Since these names
   correspond to numeric bits, the order of the keywords can not be
   changed, nor can keywords be removed or inserted (you can append
   new keywords, up to the limit of 30).

   Set keywords is a deprecated command.  It may not appear in
   future versions, or it may appear in a changed form.  It exists
   only for compatibility with MM, and should only appear in ~/.mminit
   and not in the other files.  It is likely to disappear entirely in
   IMAP4.

   There is no protection against setting these to silly values, and
   doing so is a great way to cause a crash.

4) set from-widget header-only
   Sets smart insertion of the > character in front of lines that
   begin with ``From ''.  Only such lines that are also in UNIX mbox
   header file format will have a > character inserted.  The default
   is to insert the > character in front of all lines which begin with
   ``From '', for the benefit of legacy tools that get confused
   otherwise.

5) set black-box-directory <directory name>
   Sets the directory in which the user's data can be found.  A user's
   folders can be found in a subdirectory of the black box directory
   named with the user's username.  For example, if the blackbox
   directory is /usr/spool/folders/, user jones' data can be found
   in /usr/spool/folders/jones/.  The user's black-box directory is
   the location of folders, .mminit, .imaprc, .newsrc, and all other
   files used by c-client; internally, it sets c-client's idea of the
   user's ``home directory'', overriding /etc/passwd.

   This command may not appear in ~/.mminit or ~/.imaprc

   In black-box mode, it is not permitted to access any folders
   outside of the user's personal blackbox directory.  The breakouts
   ``/'', ``~'', and ``..'' are not permitted.

   In order to make this work without crashing, you must set another
   option which is not listed in this document.

   There is no protection against setting this to a silly value, and
   doing so is a great way to cause a crash.

6) set local-host <host name>
   Sets c-client's idea of the local host name.

   There is no protection against setting this to a silly value, and
   doing so is a great way to cause a crash.

7) set news-active-file <file name>
   Sets the location of the news active file, if it is not in the
   standard place.

   It is recommended to use a courtesy symbolic link instead.

   There is no protection against setting this to a silly value, and
   doing so is a great way to cause a crash.

8) set news-spool-directory <directory name>
   Sets the location of the news spool, if it is not in the standard
   place.

   It is recommended to use a courtesy symbolic link instead.

   There is no protection against setting this to a silly value, and
   doing so is a great way to cause a crash.

9) set news-state-file <file name>
   Sets the location of the news state file (normally $(USER)/.newsrc).

   This is not very useful in /etc/c-client.cf because it is a file name.
   Setting this in /etc/c-client.cf would set all users to the same file
   as their newsrc, which is probably not what you want.

   There is no protection against setting this to a silly value, and
   doing so is a great way to cause a crash.

10) set system-inbox <file name>
   Sets the location of the "system inbox", if it is not in the standard
   place.  This is the default location of INBOX, or the mail drop point
   from which mail is snarfed (e.g. in tenex, mtx, mbox, mh formats).

   This is not very useful in /etc/c-client.cf because it is a file name.
   Setting this in /etc/c-client.cf would set all users to the same file
   as their system inbox, which is probably not what you want.

   There is no protection against setting this to a silly value, and
   doing so is a great way to cause a crash.

11) set tcp-open-timeout <number>
    Sets the number of seconds that the TCP routines will block on opening
    a TCP connection before timing out.  If a timeout occurs, the connection
    attempt is aborted.

    The default is zero, meaning use the operating system default (75
    seconds on most UNIX systems).

    There is no protection against setting this to an excessively small
    value, such as 1, and doing so is a great way to cause users extreme
    grief.

12) set tcp-read-timeout <number>
    Sets the number of seconds that the TCP routines will block on reading
    data before calling the timeout routine.  If no timeout routine is set
    by the program, the connection will be aborted on a timeout.

    The default is zero, meaning infinite.

    There is no protection against setting this to an excessively small
    value, such as 1, and doing so is a great way to cause users extreme
    grief.

13) set tcp-write-timeout <number>
    Sets the number of seconds that the TCP routines will block on sending
    data before calling the timeout routine.  If no timeout routine is set
    by the program, the connection will be aborted on a timeout.

    The default is zero, meaning infinite.

    There is no protection against setting this to an excessively small
    value, such as 1, and doing so is a great way to cause users extreme
    grief.

14) set rsh-timeout <number>
    Sets the number of seconds that the rsh routines will block on opening
    an rimapd connection before timing out.  If a timeout occurs, the
    rsh connection attempt is aborted.  A zero timeout will disable rsh.

    The default is 15 seconds.

    There is no protection against setting this to an excessively small
    value, such as 1, and doing so is a great way to cause users extreme
    grief.

15) set maximum-login-trials <number>
    Sets the number of iterations of asking the user, via mm_login(), for
    a user name and password, before cancelling the attempt.

    The default is 3.

    There is no protection against setting this to zero, and doing so is
    a great way to cause users extreme grief.

16) set lookahead <number>
    Sets the number of envelopes that are looked ahead in IMAP, in
    mail_fetchstructure().  This is based on the guess that in such
    operations as drawing browser lines, if you get data for message n
    you are likely to want it for message n+1, n+2,... in short order.
    Lookahead preloads the c-client  cache and saves unnecessary RTTs.

    The default is 20, a good number for a browser on a 24x80 screen, and
    small enough to usually have no significant real-time difference from
    a single message fetch.

    Setting it to 0 turns off lookahead.

    There is no protection against setting this ridiculously high and
    incurring performance penalties as a result.

17) set prefetch <number>
    Sets the number of envelops which are automatically fetched for the
    messages which match in a search.  This is based on the guess that
    in a browser that is "zoomed" on the results of a search, you are
    likely to want the envelope data for each of those messages in
    short order.  Prefetching reloads the c-client cache, saves
    unnecessary RTTs, and avoids loading undesired envelopes due to
    lookahead (see above).

    The default is 20.

    Setting it to 0 turns off prefetch.

    There is no protection against setting this ridiculously high and
    incurring performance penalties as a result.

18) set close-on-error <number>
    If non-zero, IMAP connections are closed if an EXAMINE or SELECT
    command fails.  Otherwise, they are left half-open, and can be used
    again to select some other mailbox.  The mailbox name in the stream
    is set to {serverhost}<no_mailbox>

    The default is zero (do not close on error).

19) set imap-port <number>
    Set the TCP/IP contact port to use for IMAP.  This overrides the
    wired-in setting and the setting from /etc/services, and can in
    turn be overridden by an explicit user specification in the mailbox
    name, e.g. {serverhost:143}foo

    The default is zero (use setting from /etc/services or the wired-in
    setting (143).

    There is no protection against setting this to a silly value, and
    doing so is a great way to cause users extreme grief.

20) set pop3-port <number>
    Set the TCP/IP contact port to use for POP3.  This overrides the
    wired-in setting and the setting from /etc/services, and can in
    turn be overridden by an explicit user specification in the mailbox
    name, e.g. {serverhost:110/pop3}

    The default is zero (use setting from /etc/services or the wired-in
    setting (110).

    There is no protection against setting this to a silly value, and
    doing so is a great way to cause users extreme grief.

21) set uid-lookahead <number>
    Sets the number of UIDs that are looked ahead in IMAP in mail_uid().
    Lookahead preloads the c-client cache and saves unnecessary RTTs.

    The default is 1000, small enough to usually have no significant
    real-time difference from a single message UID fetch.

    Setting it to 0 turns off lookahead.

    There is no protection against setting this ridiculously high and
    incurring performance penalties as a result.

22) set mailbox-protection <number>
    Set the default protection for newly-created mailbox files.

    The default is 384.

    There is no protection against setting this to a silly value, and
    doing so is a great way to screw things up massively.

23) set directory-protection <number>
    Set the default protection for newly-created directories.

    The default is 448.

    There is no protection against setting this to a silly value, and
    doing so is a great way to screw things up massively.

24) set lock-protection <number>
    Set the default protection for lock files

    The default is 438, which is necessary if locks are to be respected
    by processes running as other UIDs.

    There is no protection against setting this to a silly value, and
    contrary to what you may think just about any value other than 438
    turns out to be a silly value.

25) set disable-fcntl-locking <number>
    This only applies to SVR4 systems.

    If non-zero, fnctl() locking is not attempted.  In the past, this
    was used to avoid locking NFS files.  If NFS is involved, the evil
    lockd/statd daemons get invoked.  These daemons supposedly work over
    NFS, but really don't.

    You probably don't really want to do this, though, because now the
    flock() emulator (which calls fcntl()) now checks to see if the file
    is accessed via NFS and no-ops the lock.  This is compatible with
    BSD.

    Disabling fcntl() locking loses a great deal of locking protection
    on local files as well as NFS files (which now never have locking
    protection).

    The default is zero (fcntl() locking is enabled).

26) set lock-EACCES-error <number>
    If non-zero, a warning message is given if an attempt to create a
    lock file fails.  Otherwise, EACCES is treated as a "silent failure",
    and it proceeds without trying to use the lock file.  This is for
    the benefit of users on systems with paranoid /usr/spool/mail
    protections which don't let users create /usr/spool/mail/$(USER).lock
    files; these unfortunate users would be harassed with a flood of
    error messages otherwise.  The problem is that on SVR4, if EACCES
    remains disabled and fcntl() locking is also disabled, then there is
    no locking at all which is doubleplus-ungood.

    If the site is paranoid on /usr/spool/mail protections AND if there
    is no fcntl() locking (SVR4) or usable flock() locking (e.g. NFS),
    then there is no way to win.  Find a different system to use.

    The default is non-zero (report EACCESS as an error).

27) set list-maximum-level <number>
    Sets the maximum depth of recursion that a * wildcard list will go
    down the directory tree.  0 means that no recursion is permitted,
    and * becomes like %.

    The default is 20.

    There is no protection against setting this to a ridiculously high
    value.  Since LIST will follow symbolic links, it can effectively
    recurse infinitely, until the name strings get large enough that
    some name limit is exceeded.

28) set anonymous-home-directory <directory name>
   Sets the location of the anonymous home directory, if it is not in
   the standard  place.

   It is recommended to use a courtesy symbolic link instead.

   There is no protection against setting this to a silly value, and
   doing so is a great way to cause a crash.

29) set chroot-server <number>
   This option is for closed server systems only.  If defined, a chroot()
   call to the user's home directory is done as part of the login
   process.  This has the effect of preventing access to any files
   outside of the user's home directory (including shared mailboxes).

   Shared mailboxes with other users can't possibly work with this
   option, because there is no way to export lock information to other
   users.

   This should be done ONLY on systems which do not permit users to
   have shell access

   This option should NEVER(!!) be set if users are allowed shell access.
   Doing so actually makes the system *less* secure, since the user could
   create an etc subdirectory which would be treated as real /etc by such
   programs as /bin/su.

   The default is zero (don't do chroot).

   This option is strongly *NOT* recommended.

30) set disable-automatic-shared-namespaces <number>
   Never look up the "ftp", "imappublic", and "imapshared" users as
   posssible home directories for the #ftp, #public, and #shared
   namespaces.  On some systems (reportedly including AIX 4.3.3)
   getpwnam() of an unknown user name is horrendously slow.

   Note that this does not remove the #ftp, #public, and #shared
   namespaces, and they can still be set up by other means.

   The default is zero (shared namespaces are automatic).

31) set advertise-the-world <number>
   Include the UNIX root as a shared namespace.  This is generally a bad
   idea, since certain IMAP clients (names withheld to protect the guilty)
   will take this as license to download the entire filesystem tree.

   The default is zero (don't advertise the world).

32) set mail-subdirectory <subdirectory name>
   Change the default connected directory from the user's home directory
   to the named subdirectory of the user's home directory.  For example,
   setting MAILSUBDIR="mail" will cause the POP2 and IMAP servers to
   connect to the user's ~/mail subdirectory.  This is equivalent to
   the env_unix.c edit described in Example 2 of the CONFIG file.

   Note that if the subdirectory does not exist, the result is undefined.
   It is probably an extremely bad idea to set this unless you can
   guarantee that the subdirectory exists for all users.  If you can not
   guarantee this, then you should leave the default as the user's home
   directory and allow them to configure a personal default in their IMAP
   client.

   The default is not to use any subdirectory.

33) set allow-user-config <number>
   Allow users to use ~/.imaprc and ~/.mminit files.

   The default is zero (don't allow user config files).

34) set allow-reverse-dns <number>
   By default, the servers (ipop[23]d and imapd) will do gethostbyaddr()
   on the local and remote sockets so that imapd can identify itself
   properly (this is important when the same CPU hosts multiple virtual
   hosts on different IP addresss) and also includes the client's name
   when it writes to the syslog.  There are also client gethostbyaddr()
   calls, used primarily by authentication mechanisms.

   Setting this option to zero disables all gethostbyaddr() calls.  The
   returned "host name" string for the socket is just the bracketed
   [12.34.56.78] form, as if the reverse DNS lookup failed.

   WARNING: Some authentication mechanisms, e.g. Kerberos V, depend upon
   the host names being right, and if you set this option, it won't work.

   You should only do this if you are encountering server performance
   problems due to a misconfigured DNS, e.g. long startup delays or
   client timeouts.

   The default is non-zero (allow reverse DNS).

35) set disable-plaintext <number>
   Disable plaintext password authentication (LOGIN command, AUTH=LOGIN,
   and AUTH=PLAIN).

   The default is zero (allow plaintext authentication).

36) set trust-dns <number>
   By default, host names are canonicalized via gethostbyname() for
    everything except for SSL certificate validation.

   This can represent a security bug due to DNS spoofing, but is more
    likely to deliver results that users expect.  It also may be necessary
    for SASL authentication to work right (e.g. generating a correct name
    for a Kerberos service principal) if the name entered by the user is a
    CNAME or not a fully-qualified domain name.

   If trust-dns is set to zero, no host name canonicalization is done.
    The user's actual entered name is used for SASL authentication and
    will appear in the mailbox name of the open stream.

   The default is non-zero (do DNS canonicalization).

37) set sasl-uses-ptr-name <number>
   By default, if trust-dns is set, the host names used in authentication
    (e.g. to generate a Kerberos service principal) are canonicalized via
    gethostbyaddr() instead of by gethostbyname().  If gethostbyaddr()
    fails the gethostbyname() canonicalization is used.

   This represents an additional security bug due to DNS spoofing, over and
    above trust-dns.  It also adds an additional DNS query to starting a
    session.

   It is necessary for sites which implement a server cluster with multiple
    A records for a cluster name (instead of a CNAME) but each cluster
    member has a unique PTR record which it expects for a Kerberos service
    principal.

   If sasl-uses-ptr-name is set to zero and trust-dns is set non-zero, the
    gethostbyname() canonicalized name is used for SASL authentication.

   The setting of sasl-uses-ptr-name is irrelevant if trust-dns is set to
    zero.

   The default is non-zero (use name from PTR record for SASL).

38) set network-filesystem-stat-bug <number>
   By default, traditional UNIX mailbox files are only closed and reopened
    at checkpoint and expunge time.  This ensures that, prior to rewriting
    the file, that any cached stat() data from a network filesystem is
    updated with current data.

   Very old versions of NFS, and reputedly also AFS, can get into a state
    in which the cached stat() data stays out-of-date, even across a
    close and reopen of the file.

   If network-filesystem-stat-bug is set non-zero, then the mailbox file
    is closed and reopened at ping time as a workaround for this bug in
    these network filesystems.  This means that in imapd, the mailbox
    file is closed and reopened for every IMAP command.  This is obviously
    something that should be avoided unless absolutely necessary.

   NFS and AFS are terrible ways to distribute mail.  You use use IMAP
    servers with a local disk instead.

   The default is zero (only close/reopen at checkpoint and expunge time).

   Setting this option is a great way to ruin your system's performance.

39) set restrict-mailbox-access <option> <option> ... <option>
   This option is for closed server systems only.  It is less extreme
   than chroot-server, and allows selective restriction of what mailbox
   named users can use.  The existing options are:
    root	access not permitted to names starting with "/"
    otherusers	access not permitted to other users' names; this should
		 normally be used in conjunction with "root", otherwise
		 another user's names can be accessed via a root name.
    all		all of the above
   Setting any combination of options also disables access to superior
   directories via "..".

   This should be done ONLY on systems which do not permit users to
   have shell access

   The default is no restrictions.