Pine 4.50 for OS X 10.2 with LDAP, Kerberos and SSL support
Josh Larios <>
November 26, 2002

IMPORTANT NOTE: This is not an official release of Pine, and will not be supported by the Pine development team or help@cac. It is a modified version of version 4.50, and as such it may be unstable or dangerous. I personally think it should be ok to use, but you use it at your own risk. Also, I've only tried it on 10.2 (Jaguar). I don't think it will work on 10.1. If you want to try compiling your own copy on 10.1 and let me know what (if anything) fails, I'll try to help you out.

Download: Pine450L-X102.dmg

What I changed:

Download: pine450-osx102.patch if you want to compile Pine yourself. You'll need to make a symlink in the pine source directory in order to make kerberos work (ldap is auto-detected with a new build/ldap-setup script from the pine developers, included in the patch):
ln -s /usr krb5
The compile line I used was this:
SSLDIR=/System/Library/OpenSSL/ \
SSLLIB=/usr/lib \
The -DOSX_HACK enables the changes I made to the pine source.

Some notes about kerberos and ldap at the UW:

I know very little about kerberos. I'm amazed that I got it working here. Heh. I borrowed this configuration file from another machine, one where kerberos worked. I don't know what any of this means, but it seems to make things work on my machine. This is the file "/Library/Preferences/" from my OS X machine:

 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

 noaddresses = true 
 ticket_lifetime = 24000
 default_realm =
 dns_lookup_realm = false
 dns_lookup_kdc = false
 default_tkt_enctypes = des-cbc-crc
 default_tgs_enctypes = des-cbc-crc

[realms] = {
		kdc =
		kdc =
		admin_server =
		kpasswd_server =
		default_domain =
		v4_instance_convert = {
			u =

[domain_realm] = = = =

	krb5_get_tickets = false

 profile = /var/kerberos/krb5kdc/kdc.conf
The only part of that I changed myself was the "noaddresses = true" line. I need that because my machine is often behind a firewall which does network address translation, and without the noaddresses line, I can't get kerberos tickets which will work behind that kind of firewall.

That's pretty much all I know about kerberos. Here's what I know about ldap:

From the Pine main menu, hit "S" to go to Setup and "D" to go to Directory. Hit "A" to add a new directory. For "ldap-server" enter "". For "search-base" enter "o=University of Washington, c=US". Give it a nickname (mine is uw-ldap), and check the "use-implicitly-from-composer" feature.

Now when you compose mail, you can type a partial address, or a name, and pine will search the ldap directory and give you a list of possible matches. Pretty neat.

And that's about all I know about ldap.