The one thing that really fired up the development of the Internet as we know it today was e-mail. The protocols were designed back when the system itself was highly difficult to access, and security wasn't a significant issue. Since then, even your average household pet has heard of Internet security problems.
How many times have we read popular pronouncements not to use a certain popular e-mail program that is highly vulnerable to attacks hidden in messages? Those attacks are possible because the program is designed to make things so easy. It does everything for you. It's too easy for folks to forget the danger, because that's the software that came with their systems. That sort of large, do-it-all software takes up lots of resources, too.
There is a better way. It requires changing how you view Internet mail, going back to the original intent. In this case, it also means using what came with your system -- your FreeBSD system. However, be aware, if you do not have a mail server account with your ISP, or some other provider, you will probably have a difficult time using a built-in system mail server to send mail across the Net. Most mail services to whom you try to send mail will probably be blocking mail from dialup and DSL connections. If you cannot work this out, while you may learn a lot, you'll still be stuck using a regular mail client.
We will install Postfix and Fetchmail. You should already have Mutt
for console email. None of these work directly from the
graphical user interface (GUI), so we will spend some
more time getting used the command line interface
(CLI) environment. Recall the previous lesson on installing software
from ports. Login as root and navigate to
/usr/ports/mail/postfix. Follow the procedure for
installing and running cleaning. Be sure to select the SASL2 option
(not plain SASL) when the build options window comes up. When the
installer asks, say "yes" to setting things up automatically. Then do
the same for
To make sure Postfix is ready to run, we'll follow the instructions
from the configuration file itself. Using Joe, open
/etc/rc.conf and add these lines:
Then type these commands:
Hopefully, you'll see some messages about Sendmail stopping after the first one, and Postfix starting up after the second.
By the way, there is a reason we users of FreeBSD love the CLI. Aside from all the elitist talk of "pure computing" there is a very practical issue involved. If there is one thing likely to crash on any computer system, it is the GUI. GUI hardware is more likely to work poorly than any other hardware, so the software for it is much more difficult to write. Since we know Open Source systems run the GUI on top of the real heart of the computer, it is important that every computer user be able to work a little bit without the GUI, because you can still get most of your work done. It just requires knowing some things you haven't bothered to learn yet. If something in your system , your best chance of getting by until it's fixed is to be ready to work in the CLI. Even better, some of the best software that exists works only in the CLI. And you may be surprised to learn that the mail server software in FreeBSD takes less power, and works better and more safely, than those big bloated GUI e-mail programs.
THE E-MAIL SYSTEM
There are three parts to a proper e-mail system:
- the mail handler or mail transfer agent (MTA)
- the mail retriever which gets it from other machines
- the e-mail reader and writer, called the e-mail client
Nowadays, you can add to the list a filtering agent if you need to deal with lots of different kinds of messages or have lots of spam. However, the main three can do that to some degree internally. The first two in our list above are the backbone of what mail servers all over the world do. We've already discussed how you shouldn't run Open Source systems without using the MTA, so it is built into every one of them. The system depends on it.
THE MTA: POSTFIX
We've already done a few things to make sure Postfix runs for us internally, but not to make it work with the Internet. Here's where Postfix shines as being simple to setup: you need to change only one thing to make it work "out of the box."
It's been my experience that whatever configuration you get when you install Postfix is ready to go, but it needs only to know the name of your ISP's mail server. You see, Postfix is a mail server on your machine, and it speaks the same language as almost every other mail server out there on the Internet. Unless your ISP does really weird things, it should quite willingly accept your outgoing mail just like it came from within their own internal mail system in their office.
Login as root, and navigate to
Open the file named
main.cf with your favorite editor. A
good editor will allow the display of a line number for each line of
text, either in the right margin or somewhere in the display. Go down
to about line 308, where you should see this:
#relayhost = $mydomain
#relayhost = gateway.my.domain
#relayhost = uucphost
#relayhost = [an.ip.add.ress]
These lines are examples that you can copy, but the hashmark (#) at the front of each one prevents Postfix from reading those lines as something it needs to use. The second one is your model for most connections. Your ISP should be able to tell you the specific name of the computer that handles mail on their system. Most of them use "mail.something.com" or a similar name. Recall from the installation tutorial that this is the usual nomenclature for giving a computer an identifiable name for the Internet. At any rate, whatever your ISP tells you is what goes here. If they just give you an IP number, you can use that, too, by using the last line as your model. Just replace the letters with the digits, keeping the square brackets. For now, all IP addresses are a series of numbers divided into four sections by periods or dots.
It's probably a good idea for your own sake simply to add a new line
below these four, but without the hash mark. Finally, for
dialup connections, we have to tell the mail system to hang on to
outgoing mail until there's a live connection. At the the bottom of
main.cf put this line:
defer_transports = smtp
Save the file and close.
If it turns out you need to authenticate with your mail server in order to send anything, such as ATT/Yahoo and most other providers now do, use the following model. Be sure to ask your provider which mail relayhost is correct.
1. Note the relayhost here in brackets. At the
bottom of your
main.cf add the last three lines:
relayhost = [smtp.sbcglobal.yahoo.com]
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/usr/local/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
2. Create a file called
/usr/local/etc/postfix/. In this file you'll need this
With many providers, you'll have to make sure to use the full email
address as your authentication name. Now change permissions so others
can't read it, and run
postmap to create a database
Postfix can read:
chmod 600 /usr/local/etc/postfix/sasl_passwd
Now, at the command line type:
It should tell you that it has reloaded and restarted. If it says
anything else, you'll need to find out why. When there is a problem,
usually you'll get something like
fatal error, postfix not
running or a similar message. Try typing
If that gets you a good response, then you'll need to find out why it wasn't running already. Since the process of finding out is too complicated to put in this tutorial here, I'll invite you to google for keywords in your error message (don't forget that "freebsd" is one of your search terms), ask questions on a forum, or someone you know who runs FreeBSD. In the meantime, you can always login as root and start Postfix manually on those rare occasions when you have to reboot.
At this point, your system should know where to hand off any mail
you address for a recipient outside your system. But, be aware there
are other complications possible. For example, if you attempt to send
mail with a "From" address different than the
relayhost, most receiving mail servers will reject it as
probable spam. Such issues are far more complicated than can be covered
MAIL RETRIEVER: FETCHMAIL
I recall reading an article on the Internet where a technician wrote something like this: "Fetchmail has retrieved my mail under the worst circumstances, when nothing else could." Dialup connections can be rather fragile. If anything can get your mail, Fetchmail will do it.
You can set up Fetchmail to work automatically, and for the whole system. However, that is more complicated than necessary. Since you as the user control when you are logged in, you might as well control when and how your personal mail is fetched. Rather than change settings for the whole system, you need only create a single file -- another dot file normally hidden from view -- in your home directory.
First, a word about protocols. I've never dealt much with a mail system on the Internet that didn't use the standard known as POP3, aside from webmail. With webmail, you read your e-mail by logging on to the provider's machine, and you use their software from your web browser. With POP3, you are pulling that e-mail down to your machine. This allows dialup users to disconnect after you get it and read it later.
Create a file named
.fetchmailrc and put three lines in
it. We will format it according to a customary practice that makes it
easier to read. The first line will be the instruction where to call
for you mail. The line has three elements: command, the mail server's
name, and what protocol to use. The command is
this tells fetchmail to go ask for your mail. The server name is the
same as above, usually similar to
protocol we've already discussed:
protocol POP3. If you
want to know more about mail protocols, there are numerous articles on
the Internet written at all different levels of interest. If your ISP
doesn't use POP3, they should tell you. Most of them will understand
what you need if you tell them you are running Fetchmail. That first
line should resemble this:
poll mail.someisp.net protocol POP3
Next, you need to tell Fetchmail to match your user account name on your personal machine with the user account name you have on the remote mail server. Hopefully, you are not in the habit of using the same or a similar nickname everywhere you go. It's a security risk, though slight. You don't have to be paranoid to realize the value of being hard to find unless you want to be found. Ordinary people like me have been harassed more than once. So you start this next line indented somewhat (about 8 spaces will do) and tell Fetchmail that user so-and-so on the distant machine is the same as you on this machine. It will look like this:
user joe is user jeh
In this case, my example says that I am "joe" on the server where my mail comes in, and "jeh" on my machine at home. This way, Fetchmail will give my login name to the remote machine, and deliver to me on my machine. If your identity is something odd, such as all numerals, then you may need to put double quotation marks around it, so Fetchmail doesn't confuse it with a command. This is a standard practice in Unix software; double quotation marks tells the software: "Pass this exactly as it is."
I hope your distant mail server requires a password, too. We discussed in the Install lesson how to devise your passwords, and that they should be different everywhere you have an account. If like me you have lots of accounts at places all over the Internet, there's nothing wrong with keeping a cue-card at hand. You'll have to decide for yourself how to guard that card from prying eyes physically where you keep your computer. For sites where it really doesn't matter, where no significant personal information is kept, I do use the same password for all of them. For e-mail, don't do that.
Keeping the same indentation as the identity line, type in the
password followed by the password itself. Again,
if you use unusual characters in your password, you may need to put
double quotation marks around it:
The whole file together might look like this:
poll mail.someisp.net protocol POP3 user joe is user jeh password "G,H,P!321"
If you want to grab mail from more than one source, leave one blank line, then another set of instructions like the first. When you're done, save the file. Then you must protect it by making sure no one else can read it. Fetchmail is a little paranoid on your behalf, so using your Konqueror file browser, right click on the icon for that file, select "Properties" and click the boxes under the "Permissions" tab until it matches only the "User" line with "Read" and "Write". The other two should say "Forbidden". Click "OK". You may need to enable viewing "hidden" files in Konqueror by selecting the "View" menu, then "Show Hidden Files" -- turn it on and off as you see fit.
Now whenever you are connected to the Internet, you can go to a
Konsole window and type
fetchmail and watch as it connects
to your remote mail server, gets a message count, the size, then
downloads each one by showing dots running across the screen (each
representing roughly 1KB of data), and erasing it from the other
machine. When finished, it will come back to the prompt, and you will
have mail in your system with your user's name on it. That's because
Fetchmail only fetches it; then it hands mail off to your internal mail
server, Postfix. Postfix holds it until you call for it -- that's what
the e-mail client does. Should Fetchmail complain a great deal about
DNS or certificates, or leaves mail on the server because it can't
verify the sender domain, you can add
no dns to the end of
the first line of your
.fetchmailrc (after the
POP3) and try again.
E-MAIL CLIENT: MUTT
It's quite possible to setup Kmail to do this, or just about any
other GUI mail software you want to use. However, in keeping with our
plan to be ready to run in the CLI, we'll use Mutt. I've already
mentioned that Mutt can be setup with all sorts of nice options. For
example, you can tell Mutt to display everything in colored text. Until
you are ready to read up on all the variations possible, I'll recommend
you copy these lines below into a file named
# Color definitions
color normal white default
color header red black "date: "
color header white black "from: "
color header white black "subject: "
color header green black "cc: "
color header green black "to: "
color hdrdefault red default
color quoted green default
color signature yellow default
color indicator brightyellow black
color error brightred default
color status brightyellow blue
color tree magenta default
color tilde magenta default
color message brightcyan default
color markers brightcyan default
color attachment brightmagenta default
color search default green
color header brightred default ^(From|Subject):
color body magenta default "(ftp|http)://[^ ]+" # point out URLs
color body magenta default [-a-z_0-9.]+@[-a-z_0-9.]+
color underline brightgreen default
There are so many other options it is impossible to cover here. I
Woodnotes Guide to the Mutt Email Client as a simple place to
start. From that guide, I decided to add these lines to my
set from="firstname.lastname@example.org" set envelope_from my_hdr From: Ed Hurst
set copy=yes #keep copies of outgoing mail.
set record="/usr/home/jeh/Mail/sent-mail' "
auto_view text/html application/x-pgp-message
You'll need to create your own
.muttalias file, a sort
of address book using the following format, tabs between each item:
alias Nickname Real Name
alias Joe Joe Fish
You'll also need your own
text/html; lynx -dump -force_html %s; needsterminal; copiousoutput
application/pdf; kpdf %s
image/jpeg; kuickshow %s
image/gif; kuickshow %s
image/GIF; kuickshow %s
image/JPG; kuickshow %s
image/jpg; kuickshow %s
The first item assumes you have the Lynx web browser installed,
which will be explained in more detail later
/usr/ports/www/lynx). For now, you need to know that
first line in my mailcap allows Mutt to display HTML formatted mail
directly in Mutt. The other lines allow for a popup window to display
Save these files in your home directory. Also, if you like using Joe
as your standard console editor, you can use it in Mutt by adding this
line to your
.bashrc (create it if you don't have one
Note: this won't apply until you close Konsole and restart it.
Finally, if you have a favorite signature block you want inserted at
the bottom of all your outgoing mail, create a file named
.signature and Mutt should insert it into the editor for
you. You can read more about the huge collection of options for Mutt in
the user manual. You'll find a copy on your machine by typing this
When you are finished with setting options for Mutt, give it a try by sending a test message to yourself as root. Type the command to start Mutt by indicating the "To" address:
Normally you would need the entire email address, but without a
domain following an @ symbol, Mutt assumes it's a user on the local
system. It will ask you to confirm the address by hitting
ENTER. Then it will ask for a subject line; type and hit
ENTER again. The most common commands are shown on the top
line of the display. If you can't figure out what you need, open a
second terminal window and view the manual.
For dialup users, if you are online at that moment, Postfix should send it right away. If you are not, it will wait. On some systems, as soon as you connect to the Internet, your machine will attempt first thing to send all the mail in the queue. If this doesn't happen, you can go to the command line and type:
which tells Postfix to pass on your out-going mail.
Congratulations! You are now ready to use e-mail the way it was meant to be, according to all the best standards. It is virtually impossible for anyone to send you something that will harm your machine, because this combination of software isn't likely to react to viruses, worms, etc.
Ed Hurst is Associate Editor of Open for Business.