[tpop3d-discuss] Maildir locking, to prevent more than 1 simultaneous access?

[Rich, WhidbeyNet NOC]

Dear list,

I'm happy to say we've been running tpop3d 1.4.2 crash-free for over 2
weeks now, using auth-passwd. However today a customer uncovered a minor
problem.

When two or more clients access the same Maildir at once, tpop3d allows
all of them in. They can all get a LIST, and they all begin retrieving
and deleting mail.

Whichever client QUITs first will leave the other sessions in limbo. The
other clients will try to "RETR MSGNUMBER", and tpop3d will say "+OK
Message follows:". But because the message has either been moved to
"cur", or deleted, tpop3d just sits there, and eventually either the
client or tpop3d times out.

From the documentation, tpop3d relies on "the atomicity of certain
filesystem operations" for managing Maildir locks. And that apparently
works; no two clients can actually modify a file at once. However,
according to RFC 1939, tpop3d should be preventing two or more clients
from authenticating at all:

"Once the POP3 server has determined through the use of any
authentication command that the client should be given access to the
appropriate maildrop, the POP3 server then acquires an exclusive-access
lock on the maildrop, as necessary to prevent messages from being
modified or removed before the session enters the UPDATE state."

While this isn't a large issue, it's one that some business customers
are running into. The obvious solution is to tell people "don't POP your
mail from more than one station", but that involves forcing everyone to
turn off auto-checking and our customers wouldn't be happy.

Keep in mind we have 5 POP3 machines, who each access Maildirs over NFS.
So the only authentication lock I can think of would be with a dot-file.
In the future, could tpop3d be told to "maildir-auth-lock =
$home/Maildir/tpop3d.lock"? Or is there some way around this issue?

Feedback always appreciated!

Rich Sandberg
richs@whidbey.net
WhidbeyNet Network Operations