neulab/tldr huggingface dataset:
•   BSD only supports double quotation marks, for example ‘password "pass with spaces"’. •   BSD (only?) supports escaping of single characters via a reverse solidus (a space could be escaped via ‘\ ’), in- as well as outside of a quoted string.  This method is assumed to be present, and will actively be used to quote double quotation marks ‘"’ and reverse solidus ‘\’ characters inside the login and password tokens, for example for display purposes. •   BSD does not require a final quotation mark of the last user input token. •   The original BSD (Berknet) parser also supported a format which allowed tokens to be separated with commas – whereas at least Hewlett-Packard still seems to support this syntax, this parser does not! •   As a non-portable extension some widely-used programs support shell- style comments: if an input line starts, after any amount of whitespace, with a number sign ‘#’, then the rest of the line is ignored. •   Whereas other programs may require that the .netrc file is accessible by only the user if it contains a password token for any other login than “anonymous”, this parser will always require these strict permissions.
Of the following list of supported tokens this parser uses (and caches) machine, login and password.  An existing default entry will not be used.
machine name The hostname of the entries' machine, lowercase-normalized before use.  Any further file content, until either end-of-file or the occurrence of another machine or a default first-class token is bound (only related) to the machine name.
As an extension that should not be the cause of any worries this parser supports a single wildcard prefix for name:
machine *.example.com login USER password PASS machine pop3.example.com login USER password PASS machine smtp.example.com login USER password PASS
which would match ‘xy.example.com’ as well as ‘pop3.example.com’, but neither ‘example.com’ nor ‘local.smtp.example.com’.  In the example neither ‘pop3.example.com’ nor ‘smtp.example.com’ will be matched by the wildcard, since the exact matches take precedence (it is however faster to specify it the other way around).
default   This is the same as machine except that it is a fallback entry that is used shall none of the specified machines match; only one default token may be specified, and it must be the last first- class token.
login name The user name on the remote machine.
password string The user's password on the remote machine.
account string Supply an additional account password.  This is merely for FTP purposes.
macdef name Define a macro.  A macro is defined with the specified name; it is formed from all lines beginning with the next line and continuing until a blank line is (consecutive newline characters are) encountered.  (Note that macdef entries cannot be utilized by multiple machines, too, but must be defined following the machine they are intended to be used with.)  If a macro named init exists, it is automatically run as the last step of the login process.  This is merely for FTP purposes.
An example configuration # This example assumes v15.0 compatibility mode set v15-compat
# Request strict TLL transport layer security checks set tls-verify=strict
# Where are the up-to-date TLS certificates? # (Since we manage up-to-date ones explicitly, do not use any, # possibly outdated, default certificates shipped with OpenSSL) #set tls-ca-dir=/etc/ssl/certs set tls-ca-file=/etc/ssl/certs/ca-certificates.crt set tls-ca-no-defaults #set tls-ca-flags=partial-chain wysh set smime-ca-file="${tls-ca-file}" \ smime-ca-no-defaults #smime-ca-flags="${tls-ca-flags}"
# This could be outsourced to a central configuration file via # tls-config-file plus tls-config-module if the used library allows. # CipherString: explicitly define the list of ciphers, which may #   improve security, especially with protocols older than TLS v1.2. #   See ciphers(1).  Possibly best to only use tls-config-pairs-HOST #   (or -USER@HOST), as necessary, again.. #   Note that TLSv1.3 uses Ciphersuites= instead, which will join #   with CipherString (if protocols older than v1.3 are allowed) # Curves: especially with TLSv1.3 curves selection may be desired. # MinProtocol,MaxProtocol: do not use protocols older than TLS v1.2. #   Change this only when the remote server does not support it: #   maybe use chain support via tls-config-pairs-HOST / -USER@HOST #   to define such explicit exceptions, then, e.g., #     MinProtocol=TLSv1.1 if "$tls-features" =% ,+ctx-set-maxmin-proto, wysh set tls-config-pairs='\ CipherString=TLSv1.2:!aNULL:!eNULL:@STRENGTH,\ Curves=P-521:P-384:P-256,\ MinProtocol=TLSv1.1' else wysh set tls-config-pairs='\ CipherString=TLSv1.2:!aNULL:!eNULL:@STRENGTH,\ Curves=P-521:P-384:P-256,\ Protocol=-ALL\,+TLSv1.1 \, +TLSv1.2\, +TLSv1.3' endif
# Essential setting: select allowed character sets set sendcharsets=utf-8,iso-8859-1
# A very kind option: when replying to a message, first try to # use the same encoding that the original poster used herself! set reply-in-same-charset
# When replying, do not merge From: and To: of the original message # into To:.  Instead old From: -> new To:, old To: -> merge Cc:. set recipients-in-cc
# When sending messages, wait until the Mail-Transfer-Agent finishs. # Only like this you will be able to see errors reported through the # exit status of the MTA (including the built-in SMTP one)! set sendwait
# Only use built-in MIME types, no mime.types(5) files set mimetypes-load-control
# Default directory where we act in (relative to $HOME) set folder=mail # A leading "+" (often) means: under *folder* # *record* is used to save copies of sent messages set MBOX=+mbox.mbox DEAD=+dead.txt \ record=+sent.mbox record-files record-resent
# Make "file mymbox" and "file myrec" go to.. shortcut mymbox %:+mbox.mbox myrec +sent.mbox
# Not really optional, e.g., for S/MIME set from='Your Name <address@exam.ple>'
# It may be necessary to set hostname and/or smtp-hostname # if the "SERVER" of mta and "domain" of from do not match. # The `urlencode' command can be used to encode USER and PASS set mta=(smtps?|submissions?)://[USER[:PASS]@]SERVER[:PORT] \ smtp-auth=login/plain... \ smtp-use-starttls
# Never refuse to start into interactive mode, and more set emptystart \ colour-pager crt= \ followup-to followup-to-honour=ask-yes fullnames \ history-file=+.mailhist history-size=-1 history-gabby \ mime-counter-evidence=0b1111 \ prompt='?\$?!\$!/\$^ERRNAME[\$account#\$mailbox-display]? ' \ reply-to-honour=ask-yes \ umask=
# Only include the selected header fields when typing messages headerpick type retain from_ date from to cc subject \ message-id mail-followup-to reply-to # ...when forwarding messages headerpick forward retain subject date from to cc # ...when saving message, etc. #headerpick save ignore ^Original-.*$ ^X-.*$
# Some mailing lists mlist '@xyz-editor\.xyz$' '@xyzf\.xyz$' mlsubscribe '^xfans@xfans\.xyz$'
# Handle a few file extensions (to store MBOX databases) filetype bz2 'bzip2 -dc' 'bzip2 -zc' \ gz 'gzip -dc' 'gzip -c'  xz 'xz -dc' 'xz -zc' \ zst 'zstd -dc' 'zstd -19 -zc' \ zst.pgp 'gpg -d | zstd -dc' 'zstd -19 -zc | gpg -e'
# A real life example of a very huge free mail provider # Instead of directly placing content inside `account', # we `define' a macro: like that we can switch "accounts" # from within *on-compose-splice*, for example! define XooglX { set folder=~/spool/XooglX inbox=+syste.mbox sent=+sent set from='Your Name <address@examp.ple>'
set pop3-no-apop-pop.gmXil.com shortcut pop %:pop3s://pop.gmXil.com shortcut imap %:imaps://imap.gmXil.com # Or, entirely IMAP based setup #set folder=imaps://imap.gmail.com record="+[Gmail]/Sent Mail" \ #   imap-cache=~/spool/cache
set mta=smtp://USER:PASS@smtp.gmXil.com smtp-use-starttls # Alternatively: set mta=smtps://USER:PASS@smtp.gmail.com:465 } account XooglX { \call XooglX }
# Here is a pretty large one which does not allow sending mails # if there is a domain name mismatch on the SMTP protocol level, # which would bite us if the value of from does not match, e.g., # for people who have a sXXXXeforge project and want to speak # with the mailing list under their project account (in from), # still sending the message through their normal mail provider define XandeX { set folder=~/spool/XandeX inbox=+syste.mbox sent=+sent set from='Your Name <address@exam.ple>'
shortcut pop %:pop3s://pop.yaXXex.com shortcut imap %:imaps://imap.yaXXex.com
set mta=smtps://USER:PASS@smtp.yaXXex.com:465 \ hostname=yaXXex.com smtp-hostname= } account XandeX { \call Xandex }
# Create some new commands so that, e.g., `ls /tmp' will.. commandalias lls '!ls ${LS_COLOUR_FLAG} -aFlrS' commandalias llS '!ls ${LS_COLOUR_FLAG} -aFlS'
set pipe-message/external-body='?* echo $MAILX_EXTERNAL_BODY_URL'
# We do not support gpg(1) directly yet.  But simple --clearsign'd # message parts can be dealt with as follows: define V { localopts yes wysh set pipe-text/plain=$'?*#++=?\ < "${MAILX_FILENAME_TEMPORARY}" awk \ -v TMPFILE="${MAILX_FILENAME_TEMPORARY}" \'\ BEGIN{done=0}\ /^-----BEGIN PGP SIGNED MESSAGE-----/,/^$/ {\ if(done++ != 0)\ next;\ print "--- GPG --verify ---";\ system("gpg --verify " TMPFILE " 2>&1");\ print "--- GPG --verify ---";\ print "";\ next;\ }\ /^-----BEGIN PGP SIGNATURE-----/,\ /^-----END PGP SIGNATURE-----/{\ next;\ }\ {print}\ \'' print } commandalias V '\'call V
When storing passwords in ~/.mailrc appropriate permissions should be set on this file with ‘$ chmod 0600 ~/.mailrc’.  If the [Option]al netrc-lookup is available user credentials can be stored in the central ~/.netrc file instead; e.g., here is a different version of the example account that sets up SMTP and POP3:
define XandeX { set folder=~/spool/XandeX inbox=+syste.mbox sent=+sent set from='Your Name <address@exam.ple>' set netrc-lookup # Load an encrypted ~/.netrc by uncommenting the next line #set netrc-pipe='gpg -qd ~/.netrc.pgp'
set mta=smtps://smtp.yXXXXx.ru:465 \ smtp-hostname= hostname=yXXXXx.com set pop3-keepalive=240 pop3-no-apop-pop.yXXXXx.ru commandalias xp fi pop3s://pop.yXXXXx.ru } account XandeX { \call XandeX }
and, in the ~/.netrc file:
machine *.yXXXXx.ru login USER password PASS
This configuration should now work just fine:
$ echo text | mail -dvv -AXandeX -s Subject user@exam.ple
S/MIME step by step [Option] The first thing that is needed for Signed and encrypted messages with S/MIME is a personal certificate, and a private key.  The certificate contains public information, in particular a name and email address(es), and the public key that can be used by others to encrypt messages for the certificate holder (the owner of the private key), and to verify signed messages generated with that certificate('s private key).  Whereas the certificate is included in each signed message, the private key must be kept secret.  It is used to decrypt messages that were previously encrypted with the public key, and to sign messages.
For personal use it is recommended to get a S/MIME certificate from one of the major CAs on the Internet.  Many CAs offer such certificates for free. Usually offered is a combined certificate and private key in PKCS#12 format which Mail does not accept directly.  To convert it to PEM format, the following shell command can be used; please read on for how to use these PEM files.
$ openssl pkcs12 -in cert.p12 -out certpem.pem -clcerts -nodes $ # Alternatively $ openssl pkcs12 -in cert.p12 -out cert.pem -clcerts -nokeys $ openssl pkcs12 -in cert.p12 -out key.pem -nocerts -nodes
There is also https://www.CAcert.org which issues client and server certificates to members of their community for free; their root certificate (https://www.cacert.org/certs/root.crt) is often not in the default set of trusted CA root certificates, though, which means their root certificate has to be downloaded separately, and needs to be part of the S/MIME certificate validation chain by including it in smime-ca-dir or as a vivid member of the smime-ca-file.  But let us take a step-by-step tour on how to setup S/MIME with a certificate from CAcert.org despite this situation!
First of all you will have to become a member of the CAcert.org community, simply by registrating yourself via the web interface.  Once you are, create and verify all email addresses you want to be able to create signed and encrypted messages for/with using the corresponding entries of the web interface.  Now ready to create S/MIME certificates, so let us create a new “client certificate”, ensure to include all email addresses that should be covered by the certificate in the following web form, and also to use your name as the “common name”.
Create a private key and a certificate request on your local computer (please see the manual pages of the used commands for more in-depth knowledge on what the used arguments etc. do):
$ openssl req -nodes -newkey rsa:4096 -keyout key.pem -out creq.pem
Afterwards copy-and-paste the content of “creq.pem” into the certificate- request (CSR) field of the web form on the CAcert.org website (you may need to unfold some “advanced options” to see the corresponding text field). This last step will ensure that your private key (which never left your box) and the certificate belong together (through the public key that will find its way into the certificate via the certificate-request).  You are now ready and can create your CAcert certified certificate.  Download and store or copy-and-paste it as “pub.crt”.
Yay.  In order to use your new S/MIME setup a combined private key/public key (certificate) file has to be created:
$ cat key.pem pub.crt > ME@HERE.com.paired
This is the file Mail will work with.  If you have created your private key with a passphrase then Mail will ask you for it whenever a message is signed or decrypted, unless this operation has been automated as described in Signed and encrypted messages with S/MIME.  Set the following variables to henceforth use S/MIME (setting smime-ca-file is of interest for verification only):
? set smime-ca-file=ALL-TRUSTED-ROOT-CERTS-HERE \ smime-sign-cert=ME@HERE.com.paired \ smime-sign-digest=SHA512 \ smime-sign from=myname@my.host
Using CRLs with S/MIME or TLS [Option] Certification authorities (CAs) issue certificate revocation lists (CRLs) on a regular basis.  These lists contain the serial numbers of certificates that have been declared invalid after they have been issued. Such usually happens because the private key for the certificate has been compromised, because the owner of the certificate has left the organization that is mentioned in the certificate, etc.  To seriously use S/MIME or TLS verification, an up-to-date CRL is required for each trusted CA.  There is otherwise no method to distinguish between valid and invalidated certificates.  Mail currently offers no mechanism to fetch CRLs, nor to access them on the Internet, so they have to be retrieved by some external mechanism.
Mail accepts CRLs in PEM format only; CRLs in DER format must be converted, like, e.g.:
$ openssl crl -inform DER -in crl.der -out crl.pem
To tell Mail about the CRLs, a directory that contains all CRL files (and no other files) must be created.  The smime-crl-dir or tls-crl-dir variables, respectively, must then be set to point to that directory. After that, Mail requires a CRL to be present for each CA that is used to verify a certificate.
In general it is a good idea to turn on debug (-d) and / or verbose (-v, twice) if something does not work well.  Very often a diagnostic message can be produced that leads to the problems' solution.
Mail shortly hangs on startup This can have two reasons, one is the necessity to wait for a file lock and cannot be helped, the other being that Mail calls the function uname(2) in order to query the nodename of the box (sometimes the real one is needed instead of the one represented by the internal variable hostname).  One may have varying success by ensuring that the real hostname and ‘localhost’ have entries in /etc/hosts, or, more generally, that the name service is properly setup – and does hostname(1) return the expected value?  Does this local hostname have a domain suffix?  RFC 6762 standardized the link-local top-level domain ‘.local’, try again after adding an (additional) entry with this extension.
I cannot login to Google mail (via OAuth) Since 2014 some free service providers classify programs as “less secure” unless they use a special authentication method (OAuth 2.0) which was not standardized for non-HTTP protocol authentication token query until August 2015 (RFC 7628).
Different to Kerberos / GSSAPI, which is developed since the mid of the 1980s, where a user can easily create a local authentication ticket for her- and himself with the locally installed kinit(1) program, that protocol has no such local part but instead requires a world-wide-web query to create or fetch a token; since there is no local cache this query would have to be performed whenever Mail is invoked (in interactive sessions situation may differ).
Mail does not directly support OAuth.  It, however, supports XOAUTH2 / OAUTHBEARER, see But, how about XOAUTH2 / OAUTHBEARER? If that is not used it is necessary to declare Mail a “less secure app” (on the providers account web page) in order to read and send mail.  However, it also seems possible to take the following steps instead:
1.   give the provider the number of a mobile phone, 2.   enable “2-Step Verification”, 3.   create an application specific password (16 characters), and 4.   use that special password instead of the real Google account password in Mail (for more on that see the section On URL syntax and credential lookup).
But, how about XOAUTH2 / OAUTHBEARER? Following up I cannot login to Google mail (via OAuth) one OAuth-based authentication method is available: the OAuth 2.0 bearer token usage as standardized in RFC 6750 (according SASL mechanism in RFC 7628), also known as XOAUTH2 and OAUTHBEARER, allows fetching a temporary access token via the web that can locally be used as a password.  The protocol is simple and extendable, token updates or even password changes via a simple TLS secured server login would be possible in theory, but today a web browser and an external support tool are prerequisites for using this authentication method.  The token times out and must be periodically refreshed via the web.
Some hurdles must be taken before being able to use this method.  Using GMail as an example, an application (that is a name) must be registered, for which credentials, a “client ID” and a “client secret”, need to be created and saved locally (in a secure way).  These initial configuration steps can be performed at https://console.developers.google.com/apis/credentials Thereafter a refresh token can be requested; a python program to do this for GMail accounts is https://github.com/google/gmail-oauth2-tools/raw/master/python/oauth2.py:
$ python oauth2.py --user=EMAIL \ --client-id=THE-ID --client-secret=THE-SECRET \ --generate_oauth2_token To authorize token, visit this url and follow the directions: https://accounts.google.com/o/oauth2/auth?client_id=... Enter verification code: ... Refresh Token: ... Access Token: ... Access Token Expiration Seconds: 3600 $ # Of which the last three are actual token responses. $ # Thereafter access tokens can regularly be refreshed $ # via the created refresh token (read on)
The generated refresh token must also be saved locally (securely).  The procedure as a whole can be read at https://github.com/google/gmail- oauth2-tools/wiki/OAuth2DotPyRunThrough Since periodic timers are not yet supported, keeping an access token up-to-date (from within Mail) can only be performed via the hook on-main-loop-tick, or (for sending only) on-compose-enter (for more on authentication please see the section On URL syntax and credential lookup):
set on-main-loop-tick=o-m-l-t on-compose-enter=o-c-e define o-m-l-t { xcall update_access_token } define o-c-e { xcall update_access_token }
set access_token_=0 define update_access_token { local set i epoch_sec epoch_nsec vput vexpr i epoch eval set $i # set epoch_sec/_nsec of vexpr epoch vput vexpr i + $access_token_ 2100 if $epoch_sec -ge $i vput ! password python oauth2.py --user=EMAIL \ --client-id=THE-ID --client-secret=THE-SECRET \ --refresh-token=THE-REFRESH-TOKEN |\ sed '1b PASS;d; :PASS s/^.\{1,\}:\(.\{1,\}\)$/\1/' vput csop password trim "$password" if -n "$verbose" echo password is <$password> endif set access_token_=$epoch_sec endif }
Not "defunctional", but the editor key does not work Two thinkable situations: the first is a shadowed sequence; setting debug, or the most possible verbose mode, causes a printout of the bind tree after that is built; being a cache, this happens only upon startup or after modifying bindings.
Or second, terminal libraries (see On terminal control and line editor, bind, termcap) may report different codes than the terminal really sends, rendering bindings dysfunctional because expected and received data do not match; the verbose listing of bindings will show the byte sequences that are expected.  (One common source of problems is that the — possibly even non-existing — keypad is not turned on, and the resulting layout reports the keypad control codes for the normal keyboard keys.)
To overcome the situation use for example the program cat(1) with its option -v, if available, to see the byte sequences which are actually produced by keypresses, and use the variable termcap to make Mail aware of them.  The terminal this is typed on produces some unexpected sequences, here for an example the shifted home key:
? set verbose ? bind* # 1B 5B=[ 31=1 3B=; 32=2 48=H bind base :kHOM z0 ? x $ cat -v ^[[H $ mail -v -Stermcap='kHOM=\E[H' ? bind* # 1B 5B=[ 48=H bind base :kHOM z0
Can Mail git-send-email? Yes.  Put (at least parts of) the following in your ~/.gitconfig:
[sendemail] smtpserver = /usr/bin/mail smtpserveroption = -t #smtpserveroption = -Sexpandaddr smtpserveroption = -Athe-account-you-need ## suppresscc = all suppressfrom = false assume8bitEncoding = UTF-8 #to = /tmp/OUT confirm = always chainreplyto = true multiedit = false thread = true quiet = true annotate = true
Patches can also be send directly, for example:
$ git format-patch -M --stdout HEAD^ | mail -A the-account-you-need -t RECEIVER
Howto handle stale dotlock files folder sometimes fails to open MBOX mail databases because creation of dotlock files is impossible due to existing but unowned lock files.  Mail does not offer an option to deal with those files, because it is considered a site policy what counts as unowned, and what not.  The site policy is usually defined by administrator(s), and expressed in the configuration of a locally installed MTA (for example Postfix ‘stale_lock_time=500s’). Therefore the suggestion:
$ </dev/null mail -s 'MTA: be no frog, handle lock' $LOGNAME
By sending a mail to yourself the local MTA can use its normal queue mechanism to try the delivery multiple times, finally decide a lock file has become stale, and remove it.
[Option]ally there is IMAP client support available.  This part of the program is obsolete and will vanish in v15 with the large MIME and I/O layer rewrite, because it uses old-style blocking I/O and makes excessive use of signal based long code jumps.  Support can hopefully be readded later based on a new-style I/O, with SysV signal handling.  In fact the IMAP support had already been removed from the codebase, but was reinstantiated on user demand: in effect the IMAP code is at the level of Mail v14.8.16 (with imapcodec being the sole exception), and should be treated with some care.
IMAP uses the ‘imap://’ and ‘imaps://’ protocol prefixes, and an IMAP-based folder may be used.  IMAP URLs (paths) undergo inspections and possible transformations before use (and the command imapcodec can be used to manually apply them to any given argument).  Hierarchy delimiters are normalized, a step which is configurable via the imap-delim variable chain, but defaults to the first seen delimiter otherwise.  Mail supports internationalised IMAP names, and en- and decodes the names from and to the ttycharset as necessary and possible.  If a mailbox name is expanded (see Filename transformations) to an IMAP mailbox, all names that begin with `+' then refer to IMAP mailboxes below the folder target box, while folder names prefixed by `@' refer to folders below the hierarchy base, so the following will list all folders below the current one when in an IMAP mailbox: ‘folders @’.
Note: some IMAP servers do not accept the creation of mailboxes in the hierarchy base, but require that they are created as subfolders of `INBOX' – with such servers a folder name of the form
imaps://mylogin@imap.myisp.example/INBOX.
should be used (the last character is the server's hierarchy delimiter). The following IMAP-specific commands exist:
cache     Only applicable to cached IMAP mailboxes; takes a message list and reads the specified messages into the IMAP cache.
connect   If operating in disconnected mode on an IMAP mailbox, switch to online mode and connect to the mail server while retaining the mailbox status.  See the description of the disconnected variable for more information.
disconnect If operating in online mode on an IMAP mailbox, switch to disconnected mode while retaining the mailbox status.  See the description of the disconnected variable for more.  A list of messages may optionally be given as argument; the respective messages are then read into the cache before the connection is closed, thus ‘disco *’ makes the entire mailbox available for disconnected use.
imap      Sends command strings directly to the current IMAP server.  Mail operates always in IMAP `selected state' on the current mailbox; commands that change this will produce undesirable results and should be avoided.  Useful IMAP commands are:
create         Takes the name of an IMAP mailbox as an argument and creates it.
getquotaroot   (RFC 2087) Takes the name of an IMAP mailbox as an argument and prints the quotas that apply to the mailbox.  Not all IMAP servers support this command.
namespace      (RFC 2342) Takes no arguments and prints the Personal Namespaces, the Other User's Namespaces and the Shared Namespaces.  Each namespace type is printed in parentheses; if there are multiple namespaces of the same type, inner parentheses separate them.  For each namespace a prefix and a hierarchy separator is listed.  Not all IMAP servers support this command.
imapcodec Perform IMAP path transformations.  Supports vput (see Command modifiers), and manages the error number !.  The first argument specifies the operation: e[ncode] normalizes hierarchy delimiters (see imap-delim) and converts the strings from the locale ttycharset to the internationalized variant used by IMAP, d[ecode] performs the reverse operation.  Encoding will honour the (global) value of imap-delim.
The following IMAP-specific internal variables exist:
disconnected (Boolean) When an IMAP mailbox is selected and this variable is set, no connection to the server is initiated.  Instead, data is obtained from the local cache (see imap-cache).  Mailboxes that are not present in the cache and messages that have not yet entirely been fetched from the server are not available; to fetch all messages in a mailbox at once, the command `copy * /dev/null' can be used while still in connected mode.  Changes that are made to IMAP mailboxes in disconnected mode are queued and committed later when a connection to that server is made.  This procedure is not completely reliable since it cannot be guaranteed that the IMAP unique identifiers (UIDs) on the server still match the ones in the cache at that time.  Data is saved to DEAD when this problem occurs.
disconnected-USER@HOST The specified account is handled as described for the disconnected variable above, but other accounts are not affected.
imap-auth-USER@HOST, imap-auth Sets the IMAP authentication method.  Supported are the default ‘login’, [v15-compat] ‘oauthbearer’ (see FAQ entry But, how about XOAUTH2 / OAUTHBEARER?), [v15-compat] ‘external’ and ‘externanon’ (for TLS secured connections which pass a client certificate via tls-config-pairs), as well as the [Option]al ‘cram-md5’ and ‘gssapi’.  All methods need a user and a password except ‘gssapi’ and ‘external’, which only need the former.  ‘externanon’ solely builds upon the credentials passed via a client certificate, and is usually the way to go since tested servers do not actually follow RFC 4422, and fail if additional credentials are actually passed.
imap-cache Enables caching of IMAP mailboxes.  The value of this variable must point to a directory that is either existent or can be created by Mail.  All contents of the cache can be deleted by Mail at any time; it is not safe to make assumptions about them.
imap-delim-USER@HOST, imap-delim-HOST, imap-delim The hierarchy separator used by the IMAP server.  Whenever an IMAP path is specified it will undergo normalization.  One of the normalization steps is the squeezing and adjustment of hierarchy separators.  If this variable is set, any occurrence of any character of the given value that exists in the path will be replaced by the first member of the value; an empty value will cause the default to be used, it is ‘/.’.  If not set, we will reuse the first hierarchy separator character that is discovered in a user-given mailbox name.
imap-keepalive-USER@HOST, imap-keepalive-HOST, imap-keepalive IMAP servers may close the connection after a period of inactivity; the standard requires this to be at least 30 minutes, but practical experience may vary.  Setting this variable to a numeric `value' greater than 0 causes a `NOOP' command to be sent each `value' seconds if no other operation is performed.
imap-list-depth When retrieving the list of folders on an IMAP server, the folders command stops after it has reached a certain depth to avoid possible infinite loops.  The value of this variable sets the maximum depth allowed.  The default is 2.  If the folder separator on the current IMAP server is a slash `/', this variable has no effect and the folders command does not descend to subfolders.
imap-use-starttls-USER@HOST, imap-use-starttls-HOST, imap-use-starttls Causes Mail to issue a `STARTTLS' command to make an unencrypted IMAP session TLS encrypted.  This functionality is not supported by all servers, and is not used if the session is already encrypted by the IMAPS method.
bogofilter(1), gpg(1), more(1), newaliases(1), openssl(1), sendmail(1), sh(1), spamassassin(1), iconv(3), setlocale(3), aliases(5), termcap(5), terminfo(5), locale(7), mailaddr(7), re_format(7) (or regex(7)), mailwrapper(8), sendmail(8)
M. Douglas McIlroy writes in his article “A Research UNIX Reader: Annotated Excerpts from the Programmer's Manual, 1971-1986” that a mail(1) command already appeared in First Edition UNIX in 1971:
Electronic mail was there from the start.  Never satisfied with its exact behavior, everybody touched it at one time or another: to assure the safety of simultaneous access, to improve privacy, to survive crashes, to exploit uucp, to screen out foreign freeloaders, or whatever.  Not until v7 did the interface change (Thompson). Later, as mail became global in its reach, Dave Presotto took charge and brought order to communications with a grab-bag of external networks (v8).
BSD Mail, in large parts compatible with UNIX mail, was written in 1978 by Kurt Shoens and developed as part of the BSD UNIX distribution until 1995. This manual page is derived from “The Mail Reference Manual” that Kurt Shoens wrote for Mail 1.3, included in 3BSD in 1980.  The common UNIX and BSD denominator became standardized as mailx(1) in the X/Open Portability Guide Issue 2 (January 1987).  After the rise of Open Source BSD variants Mail saw continuous development in the individual code forks, noticeably by Christos Zoulas in NetBSD.  Based upon this Nail, later Heirloom Mailx, was developed by Gunnar Ritter in the years 2000 until 2008.  Since 2012 S-nail is maintained by Steffen Nurpmeso.
Electronic mail exchange in general is a concept even older.  The earliest well documented electronic mail system was part of the Compatible Time Sharing System (CTSS) at MIT, its MAIL command had been proposed in a staff planning memo at the end of 1964 and was implemented in mid-1965 when Tom Van Vleck and Noel Morris wrote the necessary code.  Similar communication programs were built for other timesharing systems.  One of the most ambitious and influential was Murray Turoff's EMISARI.  Created in 1971 for the United States Office of Emergency Preparedness, EMISARI combined private electronic messages with a chat system, public postings, voting, and a user directory.
During the 1960s it was common to connect a large number of terminals to a single, central computer.  Connecting two computers together was relatively unusual.  This began to change with the development of the ARPANET, the ancestor of today's Internet.  In 1971 Ray Tomlinson adapted the SNDMSG program, originally developed for the University of California at Berkeley timesharing system, to give it the ability to transmit a message across the network into the mailbox of a user on a different computer.  For the first time it was necessary to specify the recipient's computer as well as an account name.  Tomlinson decided that the underused commercial at ‘@’ would work to separate the two.
Sending a message across the network was originally treated as a special instance of transmitting a file, and so a MAIL command was included in RFC 385 on file transfer in 1972.  Because it was not always clear when or where a message had come from, RFC 561 in 1973 aimed to formalize electronic mail headers, including “from”, “date”, and “subject”.  In 1975 RFC 680 described fields to help with the transmission of messages to multiple users, including “to”, “cc”, and “bcc”.  In 1977 these features and others went from best practices to a binding standard in RFC 733. Queen Elizabeth II of England became the first head of state to send electronic mail on March 26 1976 while ceremonially opening a building in the British Royal Signals and Radar Establishment (RSRE) in Malvern.
Kurt Shoens, Edward Wang, Keith Bostic, Christos Zoulas, Gunnar Ritter. Mail is developed by Steffen Nurpmeso <s-mailx@lists.sdaoden.eu>.
[v15 behaviour may differ] Interrupting an operation via SIGINT aka ‘control-C’ from anywhere else but a command prompt is very problematic and likely to leave the program in an undefined state: many library functions cannot deal with the siglongjmp(3) that this software (still) performs; even though efforts have been taken to address this, no sooner but in v15 it will have been worked out: interruptions have not been disabled in order to allow forceful breakage of hanging network connections, for example (all this is unrelated to ignore).
The SMTP and POP3 protocol support of Mail is very basic.  Also, if it fails to contact its upstream SMTP server, it will not make further attempts to transfer the message at a later time (setting save and sendwait may be useful).  If this is a concern, it might be better to set up a local SMTP server that is capable of message queuing.
When a network-based mailbox is open, directly changing to another network- based mailbox of a different protocol (i.e., from POP3 to IMAP or vice versa) will cause a “deadlock”.
After deleting some message of a POP3 mailbox the header summary falsely claims that there are no messages to display, one needs to perform a scroll or dot movement to restore proper state.
In ‘thread’ed sort mode a power user may encounter crashes very occasionally (this is may and very).
Please report bugs to the contact-mail address, for example from within mail: ‘? eval mail $contact-mail’.  Including the verbose output of the command version may be helpful:
? wysh set escape=! verbose; vput version xy; unset verbose;\ eval mail $contact-mail Bug subject !I xy !.
Information on the web at ‘$ mail -X 'echo $contact-web; x'’.
ARP-SCAN(1)                  General Commands Manual                 ARP-SCAN(1)
arp-scan - The ARP scanner
arp-scan [options] [hosts...]
Target hosts must be specified on the command line unless the --file option is given, in which case the targets are read from the specified file instead, or the --localnet option is used, in which case the targets are generated from the network interface IP address and netmask.
You will need to be root, or arp-scan must be SUID root, in order to run arp-scan, because the functions that it uses to read and write packets require root privilege.
The target hosts can be specified as IP addresses or hostnames.  You can also specify the target as IPnetwork/bits (e.g. 192.168.1.0/24) to specify all hosts in the given network (network and broadcast addresses included), IPstart-IPend (e.g. 192.168.1.3-192.168.1.27) to specify all hosts in the inclusive range, or IPnetwork:NetMask (e.g. 192.168.1.0:255.255.255.0) to specify all hosts in the given network and mask.
arp-scan sends ARP packets to hosts on the local network and displays any responses that are received. The network interface to use can be specified with the --interface option. If this option is not present, arp-scan will search the system interface list for the lowest numbered, configured up interface (excluding loopback).  By default, the ARP packets are sent to the Ethernet broadcast address, ff:ff:ff:ff:ff:ff, but that can be changed with the --destaddr option.
The target hosts to scan may be specified in one of three ways: by specifying the targets on the command line; by specifying a file containing the targets with the --file option; or by specifying the --localnet option which causes all possible hosts on the network attached to the interface (as defined by the interface address and mask) to be scanned. For hosts specified on the command line, or with the --file option, you can use either IP addresses or hostnames.  You can also use network specifications IPnetwork/bits, IPstart-IPend, or IPnetwork:NetMask.
The list of target hosts is stored in memory.  Each host in this list uses 28 bytes of memory, so scanning a Class-B network (65,536 hosts) requires about 1.75MB of memory for the list, and scanning a Class-A (16,777,216 hosts) requires about 448MB.
arp-scan supports Ethernet and 802.11 wireless networks. It could also support token ring and FDDI, but they have not been tested. It does not support serial links such as PPP or SLIP, because ARP is not supported on them.
The ARP protocol is a layer-2 (datalink layer) protocol that is used to determine a host's layer-2 address given its layer-3 (network layer) address. ARP was designed to work with any layer-2 and layer-3 address format, but the most common use is to map IP addresses to Ethernet hardware addresses, and this is what arp-scan supports. ARP only operates on the local network, and cannot be routed. Although the ARP protocol makes use of IP addresses, it is not an IP-based protocol and arp-scan can be used on an interface that is not configured for IP.
ARP is only used by IPv4 hosts. IPv6 uses NDP (neighbour discovery protocol) instead, which is a different protocol and is not supported by arp-scan.
One ARP packet is sent for each for each target host, with the target protocol address (the ar$tpa field) set to the IP address of this host. If a host does not respond, then the ARP packet will be re-sent once more.  The maximum number of retries can be changed with the --retry option.  Reducing the number of retries will reduce the scanning time at the possible risk of missing some results due to packet loss.
You can specify the bandwidth that arp-scan will use for the outgoing ARP packets with the --bandwidth option.  By default, it uses a bandwidth of 256000 bits per second. Increasing the bandwidth will reduce the scanning time, but setting the bandwidth too high may result in an ARP storm which can disrupt network operation.  Also, setting the bandwidth too high can send packets faster than the network interface can transmit them, which will eventually fill the kernel's transmit buffer resulting in the error message: No buffer space available.  Another way to specify the outgoing ARP packet rate is with the --interval option, which is an alternative way to modify the same underlying parameter.
The time taken to perform a single-pass scan (i.e. with --retry=1) is given by:
time = n*i + t + o
Where n is the number of hosts in the list, i is the time interval between packets (specified with --interval, or calculated from --bandwidth), t is the timeout value (specified with --timeout) and o is the overhead time taken to load the targets into the list and read the MAC/Vendor mapping files.  For small lists of hosts, the timeout value will dominate, but for large lists the packet interval is the most important value.
With 65,536 hosts, the default bandwidth of 256,000 bits/second (which results in a packet interval of 2ms), the default timeout of 500ms, and a single pass ( --retry=1), and assuming an overhead of 1 second, the scan would take 65536*0.002 + 0.5 + 1 = 132.57 seconds, or about 2 minutes 13 seconds.
Any part of the outgoing ARP packet may be modified through the use of the various --arpXXX options.  The use of some of these options may make the outgoing ARP packet non RFC compliant. Different operating systems handle the various non standard ARP packets in different ways, and this may be used to fingerprint these systems.  See arp-fingerprint(1) for information about a script which uses these options to fingerprint the target operating system.
The table below summarises the options that change the outgoing ARP packet. In this table, the Field column gives the ARP packet field name from RFC 826, Bits specifies the number of bits in the field, Option shows the arp-scan option to modify this field, and Notes gives the default value and any other notes.
┌───────────────────────────────────────────────────────────────┐ │                 Outgoing ARP Packet Options                   │ ├───────┬──────┬──────────┬─────────────────────────────────────┤ │Field  │ Bits │ Option   │ Notes                               │ ├───────┼──────┼──────────┼─────────────────────────────────────┤ │ar$hrd │ 16   │ --arphrd │ Default is 1 (ARPHRD_ETHER)         │ │ar$pro │ 16   │ --arppro │ Default is 0x0800                   │ │ar$hln │ 8    │ --arphln │ Default is 6 (ETH_ALEN)             │ │ar$pln │ 8    │ --arppln │ Default is 4 (IPv4)                 │ │ar$op  │ 16   │ --arpop  │ Default is 1 (ARPOP_REQUEST)        │ │ar$sha │ 48   │ --arpsha │ Default is interface h/w address    │ │ar$spa │ 32   │ --arpspa │ Default is interface IP address     │ │ar$tha │ 48   │ --arptha │ Default is zero (00:00:00:00:00:00) │ │ar$tpa │ 32   │ None     │ Set to the target host IP address   │ └───────┴──────┴──────────┴─────────────────────────────────────┘ The most commonly used outgoing ARP packet option is --arpspa, which sets the source IP address in the ARP packet.  This option allows the outgoing ARP packet to use a different source IP address from the outgoing interface address.  With this option it is possible to use arp-scan on an interface with no IP address configured, which can be useful if you want to ensure that the testing host does not interact with the network being tested.
Warning: Setting ar$spa to the destination IP address can disrupt some operating systems, as they assume there is an IP address clash if they receive an ARP request for their own address.
It is also possible to change the values in the Ethernet frame header that precedes the ARP packet in the outgoing packets. The table below summarises the options that change values in the Ethernet frame header.
┌───────────────────────────────────────────────────────────────────┐ │                 Outgoing Ethernet Frame Options                   │ ├───────────────┬──────┬─────────────┬──────────────────────────────┤ │Field          │ Bits │ Option      │ Notes                        │ ├───────────────┼──────┼─────────────┼──────────────────────────────┤ │Dest Address   │ 48   │ --destaddr  │ Default is ff:ff:ff:ff:ff:ff │ │Source Address │ 48   │ --srcaddr   │ Default is interface address │ │Protocol Type  │ 16   │ --prototype │ Default is 0x0806            │ └───────────────┴──────┴─────────────┴──────────────────────────────┘ The most commonly used outgoing Ethernet frame option is --destaddr, which sets the destination Ethernet address for the ARP packet. --prototype is not often used, because it will cause the packet to be interpreted as a different Ethernet protocol.
Any ARP responses that are received are displayed in the following format:
<IP Address>   <Hardware Address>   <Vendor Details>
Where IP Address is the IP address of the responding target, Hardware Address is its Ethernet hardware address (also known as the MAC address) and Vendor Details are the vendor details, decoded from the hardware address.  The output fields are separated by a single tab character.
The responses are displayed in the order they are received, which is not always the same order as the requests were sent because some hosts may respond faster than others.
The vendor decoding uses the files ieee-oui.txt, ieee-iab.txt and mac- vendor.txt, which are supplied with arp-scan.  The ieee-oui.txt and ieee- iab.txt files are generated from the OUI and IAB data on the IEEE website at http://standards-oui.ieee.org/oui/oui.txt and http://standards.ieee.org/regauth/oui/iab.txt.  The Perl scripts get-oui and get-iab, which are included in the arp-scan package, can be used to update these files with the latest data from the IEEE website.  The mac- vendor.txt file contains other MAC to Vendor mappings that are not covered by the IEEE OUI and IAB files, and can be used to add custom mappings.
Almost all hosts that support IP will respond to arp-scan if they receive an ARP packet with the target protocol address (ar$tpa) set to their IP address.  This includes firewalls and other hosts with IP filtering that drop all IP traffic from the testing system. For this reason, arp-scan is a useful tool to quickly determine all the active IP hosts on a given Ethernet network segment.
Where an option takes a value, that value is specified as a letter in angle brackets. The letter indicates the type of data that is expected:
A character string, e.g. --file=hostlist.txt.
<i>    An integer, which can be specified as a decimal number or as a hexadecimal number if preceeded with 0x, e.g. --arppro=2048 or --arpro=0x0800.
<f>    A floating point decimal number, e.g. --backoff=1.5.
<m>    An Ethernet MAC address, which can be specified either in the format 01:23:45:67:89:ab, or as 01-23-45-67-89-ab. The alphabetic hex characters may be either upper or lower case. E.g. --arpsha=01:23:45:67:89:ab.
<a>    An IPv4 address, e.g. --arpspa=10.0.0.1
<h>    Binary data specified as a hexadecimal string, which should not include a leading 0x. The alphabetic hex characters may be either upper or lower case. E.g. --padding=aaaaaaaaaaaa
<x>    Something else. See the description of the option for details.
--help or -h Display this usage message and exit.
--file=
 or -f 
 Read hostnames or addresses from the specified file instead of from the command line. One name or IP address per line. Use "-" for standard input.
--localnet or -l Generate addresses from network interface configuration.  Use the network interface IP address and network mask to generate the list of target host addresses.  The list will include the network and broadcast addresses, so an interface address of 10.0.0.1 with netmask 255.255.255.0 would generate 256 target hosts from 10.0.0.0 to 10.0.0.255 inclusive.  If you use this option, you cannot specify the --file option or specify any target hosts on the command line.  The interface specifications are taken from the interface that arp-scan will use, which can be changed with the --interface option.
--retry=<i> or -r <i> Set total number of attempts per host to <i>, default=2.
--timeout=<i> or -t <i> Set initial per host timeout to <i> ms, default=500.  This timeout is for the first packet sent to each host.  subsequent timeouts are multiplied by the backoff factor which is set with --backoff.
--interval=<x> or -i <x> Set minimum packet interval to <x>.  This controls the outgoing bandwidth usage by limiting the rate at which packets can be sent. The packet interval will be no smaller than this number.  If you want to use up to a given bandwidth, then it is easier to use the --bandwidth option instead.  The interval specified is in milliseconds by default, or in microseconds if "u" is appended to the value.