Linux Security Cookbook

8.17. Receiving Mail Without a Visible Server

Problem

You want to receive Internet email without running a publicly accessible mail server or daemon.

Solution

Don’t run a mail daemon. Queue your mail on another ISP and use fetchmail to download it. Authenticate to the ISP via SSH, and transfer the email messages over an SSH tunnel. Then have fetchmail invoke your local mail delivery agent directly to deliver the mail.

               ~/.fetchmailrc:
poll imap.example.com with proto IMAP:
preauth ssh
plugin "ssh %h /usr/sbin/imapd";
user 'shawn' there is smith here;
mda "/usr/sbin/sendmail -oem -f %F %T"
fetchall;
no keep;

~/.bash_profile:
if [ -z "$SSH_AGENT_PID" ]
then
        eval `/usr/bin/ssh-agent` > /dev/null 2> /dev/null
fi

~/.bashrc:
(/usr/bin/ssh-add -l | /bin/grep -q 'no identities') \
        && /usr/bin/ssh-add \
        && /usr/bin/fetchmail -d 600

Discussion

fetchmail is the Swiss army knife of mail delivery. Using a powerful configuration mechanism (~/.fetchmailrc), fetchmail can poll remote IMAP and POP servers, retrieve messages, and forward them through sendmail and other mail delivery systems.

For security reasons, you might not want a sendmail daemon visible to the outside world, and yet you want mail delivered locally. For example, the machine where you read mail could be behind a firewall.

This recipe is run by user smith on the local machine. When he logs in, the given commands in his .bash_profile and .bashrc make sure an SSH agent [Recipe 6.9] is running and is loaded with the necessary keys. ...