diff --git a/documentation/content/en/books/handbook/mail/_index.adoc b/documentation/content/en/books/handbook/mail/_index.adoc --- a/documentation/content/en/books/handbook/mail/_index.adoc +++ b/documentation/content/en/books/handbook/mail/_index.adoc @@ -4,7 +4,7 @@ prev: books/handbook/ppp-and-slip next: books/handbook/network-servers description: This chapter provides a basic introduction to running a mail server on FreeBSD, as well as an introduction to sending and receiving email using FreeBSD -tags: ["mail", "sendmail", "MTA", "SMTP", "user agents", "fetchmail", "procmail", "alpine", "mut"] +tags: ["mail", "sendmail", "dma", "MTA", "SMTP", "mail user agents", "fetchmail", "procmail", "alpine", "mutt", "postfix"] showBookMenu: true weight: 36 path: "/books/handbook/" @@ -48,100 +48,177 @@ include::../../../../../shared/asciidoctor.adoc[] endif::[] +// Info: +// https://man.freebsd.org/cgi/man.cgi?query=dma +// https://wiki.mageia.org/en/Dma_Dragonfly_Mail_Agent +// https://www.dragonflybsd.org/handbook/mta/ +// https://herrbischoff.com/2021/10/freebsd-13-simple-outgoing-email-with-dma/ +// https://jpmens.net/2020/03/05/simple-solution-for-outgoing-mail-from-a-freebsd-system/ +// https://wiki.archlinux.org/title/Dma +// https://forums.freebsd.org/threads/dma-makes-sense.52219/ + [[mail-synopsis]] == Synopsis "Electronic Mail", better known as email, is one of the most widely used forms of communication today. -This chapter provides a basic introduction to running a mail server on FreeBSD, as well as an introduction to sending and receiving email using FreeBSD +This chapter provides a basic introduction to running a mail server on FreeBSD, as well as an introduction to sending and receiving email using FreeBSD. For more complete coverage of this subject, refer to the books listed in crossref:bibliography[bibliography,Bibliography]. -After reading this chapter, you will know: +This chapter covers: * Which software components are involved in sending and receiving electronic mail. +* How to configure DragonFly Mail Agent. * Where basic Sendmail configuration files are located in FreeBSD. * The difference between remote and local mailboxes. -* How to block spammers from illegally using a mail server as a relay. -* How to install and configure an alternate Mail Transfer Agent, replacing Sendmail. +* How to install and configure an alternate Mail Transfer Agent, replacing DragonFly Mail Agent or Sendmail. * How to troubleshoot common mail server problems. -* How to set up the system to send mail only. -* How to use mail with a dialup connection. -* How to configure SMTP authentication for added security. +* How to configure Sendmail to only send mail. +* How to configure SMTP authentication for added security in Sendmail. * How to install and use a Mail User Agent, such as mutt, to send and receive email. * How to download mail from a remote POP or IMAP server. * How to automatically apply filters and rules to incoming email. -Before reading this chapter, you should: - -* Properly set up a network connection (crossref:advanced-networking[advanced-networking,Advanced Networking]). -* Properly set up the DNS information for a mail host (crossref:network-servers[network-servers,Network Servers]). -* Know how to install additional third-party software (crossref:ports[ports,Installing Applications: Packages and Ports]). - [[mail-using]] == Mail Components -There are five major parts involved in an email exchange: the Mail User Agent (MUA), the Mail Transfer Agent (MTA), a mail host, a remote or local mailbox, and DNS. This section provides an overview of these components. +There are five major parts involved in an email exchange: the Mail User Agent (MUA), the Mail Transfer Agent (MTA), a mail host, a remote or local mailbox, and DNS. +This section provides an overview of these components. Mail User Agent (MUA):: The Mail User Agent (MUA) is an application which is used to compose, send, and receive emails. -This application can be a command line program, such as the built-in `mail` utility or a third-party application from the Ports Collection, such as mutt, alpine, or elm. +This application can be a command line program, such as the built-in `mail` utility or a third-party application from the Ports Collection, such as alpine, elm, or mutt. Dozens of graphical programs are also available in the Ports Collection, including Claws Mail, Evolution, and Thunderbird. Some organizations provide a web mail program which can be accessed through a web browser. More information about installing and using a MUA on FreeBSD can be found in <>. Mail Transfer Agent (MTA):: The Mail Transfer Agent (MTA) is responsible for receiving incoming mail and delivering outgoing mail. -FreeBSD ships with Sendmail as the default MTA, but it also supports numerous other mail server daemons, including Exim, Postfix, and qmail. -Sendmail configuration is described in <>. -If another MTA is installed using the Ports Collection, refer to its post-installation message for FreeBSD-specific configuration details and the application's website for more general configuration instructions. +Starting with FreeBSD version 14.0, the default MTA is DragonFly Mail Agent (man:dma[8]); in earlier versions, it is man:sedmail[8]. +Other MTAs, including Exim, Postfix, and qmail, may be installed to replace the default MTA. Mail Host and Mailboxes:: The mail host is a server that is responsible for delivering and receiving mail for a host or a network. -The mail host collects all mail sent to the domain and stores it either in the default [.filename]#mbox# or the alternative Maildir format, depending on the configuration. +The mail host collects all mail sent to the domain and stores it either in the default `mbox` or the alternative Maildir format, depending on the configuration. Once mail has been stored, it may either be read locally using a MUA or remotely accessed and collected using protocols such as POP or IMAP. If mail is read locally, a POP or IMAP server does not need to be installed. -+ -To access mailboxes remotely, a POP or IMAP server is required as these protocols allow users to connect to their mailboxes from remote locations. -IMAP offers several advantages over POP. -These include the ability to store a copy of messages on a remote server after they are downloaded and concurrent updates. -IMAP can be useful over low-speed links as it allows users to fetch the structure of messages without downloading them. -It can also perform tasks such as searching on the server in order to minimize data transfer between clients and servers. -+ -Several POP and IMAP servers are available in the Ports Collection. -These include package:mail/qpopper[], package:mail/imap-uw[], package:mail/courier-imap[], and package:mail/dovecot2[]. -+ -[WARNING] -==== -It should be noted that both POP and IMAP transmit information, including username and password credentials, in clear-text. -To secure the transmission of information across these protocols, consider tunneling sessions over man:ssh[1] (crossref:security[security-ssh-tunneling,"SSH Tunneling"]) or using SSL (crossref:security[openssl,"OpenSSL"]). -==== Domain Name System (DNS):: -The Domain Name System (DNS) and its daemon `named` play a large role in the delivery of email. +The Domain Name System (DNS) and its daemon man:named[8] play a large role in the delivery of mail. In order to deliver mail from one site to another, the MTA will look up the remote site in DNS to determine which host will receive mail for the destination. This process also occurs when mail is sent from a remote host to the MTA. -+ -In addition to mapping hostnames to IP addresses, DNS is responsible for storing information specific to mail delivery, known as Mail eXchanger MX records. -The MX record specifies which hosts will receive mail for a particular domain. -+ -To view the MX records for a domain, specify the type of record. -Refer to man:host[1], for more details about this command: -+ + +[[dragonFly-mail-agent]] +== DragonFly Mail Agent (DMA) + +DragonFly Mail Agent (DMA) is the default MTA in FreeBSD starting with version 14.0. +man:dma[8] is a small Mail Transport Agent (MTA), designed for home and office use. +It accepts mails from locally installed Mail User Agents (MUA) and delivers the mails either locally or to a remote destination. +Remote delivery includes several features like TLS/SSL support and SMTP authentication. + +man:dma[8] is not intended as a replacement for real, big MTAs like man:sendmail[8] or man:postfix[1]. +Consequently, man:dma[8] does not listen on port 25 for incoming connections. + +[[configuring-dragonFly-mail-agent]] +=== Configuring DragonFly Mail Agent (DMA) + +DMA comes with a default configuration that will be suitable for many deployments. +Custom settings are defined in [.filename]#/etc/dma/dma.conf#, and SMTP authentication is configured in [.filename]#/etc/dma/auth.conf#. + +[[configuring-gmail-dma]] +==== Using DMA to Route Outgoing Mail through Gmail (STARTTLS:SMTP example) + +This example [.filename]#/etc/dma/dma.conf# can be used to send mail using Google's SMTP servers. + +[.programlisting] +.... +SMARTHOST smtp.gmail.com +PORT 587 +AUTHPATH /etc/dma/auth.conf +SECURETRANSFER +STARTTLS +MASQUERADE username@gmail.com +.... + +Authentication can be set with one line in [.filename]#/etc/dma/auth.conf#: + +[.programlisting] +.... +username@gmail.com|smtp.gmail.com:password +.... + +Execute the following command to test the configuration: + [source,shell] .... -% host -t mx FreeBSD.org -FreeBSD.org mail is handled by 10 mx1.FreeBSD.org +% echo this is a test | mail -v -s testing-email username@gmail.com +.... + +[[configuring-fastmail-dma]] +==== Using DMA to Route Outgoing Mail through Fastmail (SSL/TLS example) + +This example [.filename]#/etc/dma/dma.conf# can be used to send mail using Fastmail's SMTP servers. + +[.programlisting] +.... +SMARTHOST smtp.fastmail.com +PORT 465 +AUTHPATH /etc/dma/auth.conf +SECURETRANSFER +MAILNAME example.server.com +.... + +Authentication can be set with one line in [.filename]#/etc/dma/auth.conf#: + +[.programlisting] +.... +username@fastmail.com|smtp.fastmail.com:password +.... + +Execute the following command to test the configuration: + +[source,shell] +.... +% echo this is a test | mail -v -s testing-email username@fastmail.com +.... + +[[configuring-custom-dma]] +==== Using DMA to Route Outgoing Mail through a Custom Mail Host + +This example [.filename]#/etc/dma/dma.conf# can be used to send mail using a custom mail host. + +[.programlisting] +.... +SMARTHOST mail.example.org +PORT 587 +AUTHPATH /etc/dma/auth.conf +SECURETRANSFER +STARTTLS +.... + +Authentication can be set with one line in [.filename]#/etc/dma/auth.conf#: + +[.programlisting] +.... +username@example.org|mail.example.org:password +.... + +Execute the following command to test the configuration: + +[source,shell] +.... +% echo this is a test | mail -v -s testing-email username@example.org .... -+ -Refer to crossref:network-servers[network-dns,"Domain Name System (DNS)"] for more information about DNS and its configuration. [[sendmail]] -== Sendmail Configuration Files +== Sendmail + +Sendmail is a venerable and versatile Mail Transfer Agent (MTA) with a long history in UNIX(R) and UNIX-like systems. +It was a part of the FreeBSD base system until FreeBSD 13, offering robust email transport capabilities, extensive customization options, and support for complex routing and filtering. -Sendmail is the default MTA installed with FreeBSD. It accepts mail from MUAs and delivers it to the appropriate mail host, as defined by its configuration. -Sendmail can also accept network connections and deliver mail to local mailboxes or to another program. +[[configuring-sendmail]] +=== Configuration Files -The configuration files for Sendmail are located in [.filename]#/etc/mail#. -This section describes these files in more detail. +The configuration files for Sendmail are located in [.filename]#/etc/mail/#. [.filename]#/etc/mail/access#:: This access database file defines which hosts or IP addresses have access to the local mail server and what kind of access they have. @@ -154,26 +231,6 @@ + Examples of using these options for both IPv4 and IPv6 addresses can be found in the FreeBSD sample configuration, [.filename]#/etc/mail/access.sample#: + -[.programlisting] -.... -# $FreeBSD$ -# -# Mail relay access control list. Default is to reject mail unless the -# destination is local, or listed in /etc/mail/local-host-names -# -## Examples (commented out for safety) -#From:cyberspammer.com ERROR:"550 We don't accept mail from spammers" -#From:okay.cyberspammer.com OK -#Connect:sendmail.org RELAY -#To:sendmail.org RELAY -#Connect:128.32 RELAY -#Connect:128.32.2 SKIP -#Connect:IPv6:1:2:3:4:5:6:7 RELAY -#Connect:suspicious.example.com QUARANTINE:Mail from suspicious host -#Connect:[127.0.0.3] OK -#Connect:[IPv6:1:2:3:4:5:6:7:8] OK -.... -+ To configure the access database, use the format shown in the sample to make entries in [.filename]#/etc/mail/access#, but do not put a comment symbol (`+#+`) in front of the entries. Create an entry for each host or network whose access should be configured. Mail senders that match the left side of the table are affected by the action on the right side of the table. @@ -273,67 +330,46 @@ [[mail-changingmta]] == Changing the Mail Transfer Agent -FreeBSD comes with Sendmail already installed as the MTA which is in charge of outgoing and incoming mail. +Starting with FreeBSD version 14.0, man:dma[8] in the default MTA, and before 14.0, the default MTA is man:sendmail[8]. However, the system administrator can change the system's MTA. A wide choice of alternative MTAs is available from the `mail` category of the FreeBSD Ports Collection. -Once a new MTA is installed, configure and test the new software before replacing Sendmail. -Refer to the documentation of the new MTA for information on how to configure the software. - -Once the new MTA is working, use the instructions in this section to disable Sendmail and configure FreeBSD to use the replacement MTA. - -[[mail-disable-sendmail]] -=== Disable Sendmail - [WARNING] ==== - -If Sendmail's outgoing mail service is disabled, it is important that it is replaced with an alternative mail delivery system. +If the default's outgoing mail service is disabled, it is important that it is replaced with an alternative mail delivery system. Otherwise, system functions such as man:periodic[8] will be unable to deliver their results by email. Many parts of the system expect a functional MTA. -If applications continue to use Sendmail's binaries to try to send email after they are disabled, mail could go into an inactive Sendmail queue and never be delivered. +If applications continue to use the default binaries to try to send email after they are disabled, mail could go into an inactive queue and never be delivered. ==== -In order to completely disable Sendmail, add or edit the following lines in [.filename]#/etc/rc.conf#: - -[.programlisting] -.... -sendmail_enable="NO" -sendmail_submit_enable="NO" -sendmail_outbound_enable="NO" -sendmail_msp_queue_enable="NO" -.... +[[replace-sendmail-dma]] +=== Replacing Sendmail with Other MTA -To only disable Sendmail's incoming mail service, use only this entry in [.filename]#/etc/rc.conf#: +In order to completely disable man:sendmail[8] execute the following commands: -[.programlisting] +[source,shell] .... -sendmail_enable="NO" +# sysrc sendmail_enable="NO" +# sysrc sendmail_submit_enable="NO" +# sysrc sendmail_outbound_enable="NO" +# sysrc sendmail_msp_queue_enable="NO" .... -More information on Sendmail's startup options is available in man:rc.sendmail[8]. - -=== Replace the Default MTA - -When a new MTA is installed using the Ports Collection, its startup script is also installed and startup instructions are mentioned in its package message. -Before starting the new MTA, stop the running Sendmail processes. -This example stops all of these services, then starts the Postfix service: +To only disable man:sendmail[8]'s incoming mail service execute the following command: [source,shell] .... -# service sendmail stop -# service postfix start +# sysrc sendmail_enable="NO" .... -To start the replacement MTA at system boot, add its configuration line to [.filename]#/etc/rc.conf#. -This entry enables the Postfix MTA: +Then stop the man:sendmail[8] service: -[.programlisting] +[source,shell] .... -postfix_enable="YES" +# service sendmail onestop .... -Some extra configuration is needed as Sendmail is so ubiquitous that some software assumes it is already installed and configured. +Some extra configuration is needed as man:sendmail[8] is so ubiquitous that some software assumes it is already installed and configured. Check [.filename]#/etc/periodic.conf# and make sure that these values are set to `NO`. If this file does not exist, create it with these entries: @@ -345,775 +381,582 @@ daily_submit_queuerun="NO" .... -Some alternative MTAs provide their own compatible implementations of the Sendmail command-line interface in order to facilitate using them as drop-in replacements for Sendmail. -However, some MUAs may try to execute standard Sendmail binaries instead of the new MTA's binaries. -FreeBSD uses [.filename]#/etc/mail/mailer.conf# to map the expected Sendmail binaries to the location of the new binaries. -More information about this mapping can be found in man:mailwrapper[8]. +The next step is to install another MTA, man:dma[8] will be used in this example. +As pointed above, man:dma[8] is the default MTA in FreeBSD starting with version 14.0. +Therefore, it is only necessary to install it from the ports if you are using a previous version. -The default [.filename]#/etc/mail/mailer.conf# looks like this: +To install it execute the following command: -[.programlisting] +[source,shell] .... -# $FreeBSD$ -# -# Execute the "real" sendmail program, named /usr/libexec/sendmail/sendmail -# -sendmail /usr/libexec/sendmail/sendmail -send-mail /usr/libexec/sendmail/sendmail -mailq /usr/libexec/sendmail/sendmail -newaliases /usr/libexec/sendmail/sendmail -hoststat /usr/libexec/sendmail/sendmail -purgestat /usr/libexec/sendmail/sendmail +# pkg install dma .... -When any of the commands listed on the left are run, the system actually executes the associated command shown on the right. -This system makes it easy to change what binaries are executed when these default binaries are invoked. +Perform the configuration as indicated in <>. -Some MTAs, when installed using the Ports Collection, will prompt to update this file for the new binaries. -For example, Postfix will update the file like this: +Then change all the entries in the file [.filename]#/etc/mail/mailer.conf# to man:dma[8]: [.programlisting] .... +# $FreeBSD$ # -# Execute the Postfix sendmail program, named /usr/local/sbin/sendmail +# Execute the "real" sendmail program, named /usr/libexec/sendmail/sendmail +# +# If dma(8) is installed, an example mailer.conf that uses dma(8) instead can +# be found in /usr/share/examples/dma # -sendmail /usr/local/sbin/sendmail -send-mail /usr/local/sbin/sendmail -mailq /usr/local/sbin/sendmail -newaliases /usr/local/sbin/sendmail +sendmail /usr/local/libexec/dma +mailq /usr/local/libexec/dma +newaliases /usr/local/libexec/dma .... -If the installation of the MTA does not automatically update [.filename]#/etc/mail/mailer.conf#, edit this file in a text editor so that it points to the new binaries. -This example points to the binaries installed by package:mail/ssmtp[]: +[NOTE] +==== +When using the version of man:dma[8] included in the base system, the paths will change to [.filename]#/usr/libexec/dma#. +==== + +To ensure that anything in the queue is flushed at boot or before shutdown, execute the following command: -[.programlisting] +[source,shell] .... -sendmail /usr/local/sbin/ssmtp -send-mail /usr/local/sbin/ssmtp -mailq /usr/local/sbin/ssmtp -newaliases /usr/local/sbin/ssmtp -hoststat /usr/bin/true -purgestat /usr/bin/true +# sysrc dma_flushq_enable="YES" .... Once everything is configured, it is recommended to reboot the system. Rebooting provides the opportunity to ensure that the system is correctly configured to start the new MTA automatically on boot. -[[mail-trouble]] -== Troubleshooting +[[replace-dma]] +=== Replacing DragonFly Mail Agent (DMA) with Other MTA -=== Why do I have to use the FQDN for hosts on my site? +As noted above, starting with FreeBSD version 14.0, the default MTA is DMA. +In this example, package:mail/postfix[] will be used as the alternative MTA. -The host may actually be in a different domain. -For example, in order for a host in `foo.bar.edu` to reach a host called `mumble` in the `bar.edu` domain, refer to it by the Fully-Qualified Domain Name FQDN, `mumble.bar.edu`, instead of just `mumble`. +Before installing package:mail/postfix[] some extra configuration is needed. +Check [.filename]#/etc/periodic.conf# and make sure that these values are set to `NO`. +If this file does not exist, create it with these entries: + +[.programlisting] +.... +daily_clean_hoststat_enable="NO" +daily_status_mail_rejects_enable="NO" +daily_status_include_submit_mailq="NO" +daily_submit_queuerun="NO" +.... -This is because the version of BIND which ships with FreeBSD no longer provides default abbreviations for non-FQDNs other than the local domain. -An unqualified host such as `mumble` must either be found as `mumble.foo.bar.edu`, or it will be searched for in the root domain. +Then install package:mail/postfix[]: -In older versions of BIND, the search continued across `mumble.bar.edu`, and `mumble.edu`. -RFC 1535 details why this is considered bad practice or even a security hole. +[source,shell] +.... +# pkg install postfix +.... -As a good workaround, place the line: +To start package:mail/postfix[] at system boot execute the following command: -[.programlisting] +[source,shell] .... -search foo.bar.edu bar.edu +# sysrc postfix_enable="YES" .... -instead of the previous: +[TIP] +==== +It is good practice to read the installation message after installing an application. +Provides useful information about settings, etc. +==== + +If postfix is *not* already activated in [.filename]#/usr/local/etc/mail/mailer.conf# execute the following commands: -[.programlisting] +[source,shell] .... -domain foo.bar.edu +mv /usr/local/etc/mail/mailer.conf /usr/local/etc/mail/mailer.conf.old +install -d /usr/local/etc/mail +install -m 0644 /usr/local/share/postfix/mailer.conf.postfix /usr/local/etc/mail/mailer.conf .... -into [.filename]#/etc/resolv.conf#. -However, make sure that the search order does not go beyond the "boundary between local and public administration", as RFC 1535 calls it. +When employing SASL, ensure that postfix has access to read the sasldb file. +This is accomplished by adding postfix to group mail and making the [.filename]#/usr/local/etc/sasldb*# file(s) readable by group mail (this should be the default for new installs). + +Once everything is configured, it is recommended to reboot the system. +Rebooting provides the opportunity to ensure that the system is correctly configured to start the new MTA automatically on boot. + +[[mail-agents]] +== Mail User Agents + +A MUA is an application that is used to send and receive email. +As email "evolves" and becomes more complex, MUAs are becoming increasingly powerful and provide users increased functionality and flexibility. +The `mail` category of the FreeBSD Ports Collection contains numerous MUAs. +These include graphical email clients such as Evolution or Balsa and console based clients such as mutt or alpine. + +[[mail-command]] +=== mail -=== How can I run a mail server on a dial-up PPP host? +man:mail[1] is the default MUA installed with FreeBSD. +It is a console based MUA that offers the basic functionality required to send and receive text-based email. +It provides limited attachment support and can only access local mailboxes. -Connect to a FreeBSD mail gateway on the LAN. The PPP connection is non-dedicated. +Although man:mail[1] does not natively support interaction with POP or IMAP servers, these mailboxes may be downloaded to a local `mbox` using an application such as fetchmail or getmail. -One way to do this is to get a full-time Internet server to provide secondary MX services for the domain. -In this example, the domain is `example.com` and the ISP has configured `example.net` to provide secondary MX services to the domain: +In order to send and receive email, run man:mail[1]: -[.programlisting] +[source,shell] .... -example.com. MX 10 example.com. - MX 20 example.net. +% mail .... -Only one host should be specified as the final recipient. -For Sendmail, add `Cw example.com` in [.filename]#/etc/mail/sendmail.cf# on `example.com`. - -When the sending MTA attempts to deliver mail, it will try to connect to the system, `example.com`, over the PPP link. -This will time out if the destination is offline. -The MTA will automatically deliver it to the secondary MX site at the Internet Service Provider (ISP), `example.net`. -The secondary MX site will periodically try to connect to the primary MX host, `example.com`. +The contents of the user's mailbox in [.filename]#/var/mail# are automatically read by man:mail[1]. +Should the mailbox be empty, the utility exits with a message indicating that no mail could be found. +If mail exists, the application interface starts, and a list of messages will be displayed. -Use something like this as a login script: +Messages are automatically numbered, as can be seen in the following example: [.programlisting] .... -#!/bin/sh -# Put me in /usr/local/bin/pppmyisp -( sleep 60 ; /usr/sbin/sendmail -q ) & -/usr/sbin/ppp -direct pppmyisp +Mail version 8.1 6/6/93. Type ? for help. +"/var/mail/username": 3 messages 3 new +>N 1 root@localhost Mon Mar 8 14:05 14/510 "test" + N 2 root@localhost Mon Mar 8 14:05 14/509 "user account" + N 3 root@localhost Mon Mar 8 14:05 14/509 "sample" .... -When creating a separate login script for users, instead use `sendmail -qRexample.com` in the script above. -This will force all mail in the queue for `example.com` to be processed immediately. +Messages can now be read by typing kbd:[t] followed by the message number. -A further refinement of the situation can be seen from this example from the {freebsd-isp}: +This example reads the first email: [.programlisting] .... -> we provide the secondary MX for a customer. The customer connects to -> our services several times a day automatically to get the mails to -> his primary MX (We do not call his site when a mail for his domains -> arrived). Our sendmail sends the mailqueue every 30 minutes. At the -> moment he has to stay 30 minutes online to be sure that all mail is -> gone to the primary MX. -> -> Is there a command that would initiate sendmail to send all the mails -> now? The user has not root-privileges on our machine of course. +& t 1 +Message 1: +From root@localhost Mon Mar 8 14:05:52 2004 +X-Original-To: username@localhost +Delivered-To: username@localhost +To: username@localhost +Subject: test +Date: Mon, 8 Mar 2004 14:05:52 +0200 (SAST) +From: root@localhost (Charlie Root) + +This is a test message, please reply if you receive it. +.... -In the privacy flags section of sendmail.cf, there is a -definition Opgoaway,restrictqrun +As seen in this example, the message will be displayed with full headers. + +To display the list of messages again, press kbd:[h]. -Remove restrictqrun to allow non-root users to start the queue processing. -You might also like to rearrange the MXs. We are the 1st MX for our -customers like this, and we have defined: +If the email requires a reply, press either kbd:[R] or kbd:[r] man:mail[1] keys. +kbd:[R] instructs man:mail[1] to reply only to the sender of the email, while kbd:[r] replies to all other recipients of the message. +These commands can be suffixed with the mail number of the message to reply to. +After typing the response, the end of the message should be marked by a single kbd:[.] on its own line. -# If we are the best MX for a host, try directly instead of generating -# local config error. -OwTrue +An example can be seen below: -That way a remote site will deliver straight to you, without trying -the customer connection. You then send to your customer. Only works for -hosts, so you need to get your customer to name their mail -machine customer.com as well as -hostname.customer.com in the DNS. Just put an A record in -the DNS for customer.com. +[.programlisting] .... +& R 1 +To: root@localhost +Subject: Re: test -[[mail-advanced]] -== Advanced Topics +Thank you, I did get your email. +. +EOT +.... -This section covers more involved topics such as mail configuration and setting up mail for an entire domain. +In order to send a new email, press kbd:[m], followed by the recipient email address. +Multiple recipients may be specified by separating each address with the kbd:[,] delimiter. +The subject of the message may then be entered, followed by the message contents. +The end of the message should be specified by putting a single kbd:[.] on its own line. -[[mail-config]] -=== Basic Configuration +[.programlisting] +.... +& mail root@localhost +Subject: I mastered mail -Out of the box, one can send email to external hosts as long as [.filename]#/etc/resolv.conf# is configured or the network has access to a configured DNS server. -To have email delivered to the MTA on the FreeBSD host, do one of the following: +Now I can send and receive email using mail ... :) +. +EOT +.... -* Run a DNS server for the domain. -* Get mail delivered directly to the FQDN for the machine. +While using man:mail[1], press kbd:[?] to display help at any time. +Refer to man:mail[1] for more help on how to use man:mail[1]. -In order to have mail delivered directly to a host, it must have a permanent static IP address, not a dynamic IP address. -If the system is behind a firewall, it must be configured to allow SMTP traffic. -To receive mail directly at a host, one of these two must be configured: +[NOTE] +==== +man:mail[1] was not designed to handle attachments and thus deals with them poorly. +Newer MUAs handle attachments in a more intelligent way. +==== -* Make sure that the lowest-numbered MX record in DNS points to the host's static IP address. -* Make sure there is no MX entry in the DNS for the host. +[[mutt-command]] +=== Mutt -Either of the above will allow mail to be received directly at the host. +Mutt is a powerful MUA, with many features, including: -Try this: +* The ability to thread messages. +* PGP support for digital signing and encryption of email. +* MIME support. +* Maildir support. +* Highly customizable. -[source,shell] -.... -# hostname -example.FreeBSD.org -# host example.FreeBSD.org -example.FreeBSD.org has address 204.216.27.XX -.... +Refer to link:http://www.mutt.org[http://www.mutt.org] for more information on Mutt. -In this example, mail sent directly to mailto:yourlogin@example.FreeBSD.org[yourlogin@example.FreeBSD.org] should work without problems, assuming Sendmail is running correctly on `example.FreeBSD.org`. +[TIP] +==== +A Mutt fork called NeoMutt is worth mentioning, which brings added features. +See more on the link:https://neomutt.org/about.html[NeoMutt website]. +If NeoMutt was chosen, replace the following command examples from `mutt` to `neomutt`. +==== -For this example: +Mutt may be installed using the package:mail/mutt[] port. +After the port has been installed, Mutt can be started by issuing the following command: [source,shell] .... -# host example.FreeBSD.org -example.FreeBSD.org has address 204.216.27.XX -example.FreeBSD.org mail is handled (pri=10) by nevdull.FreeBSD.org +% mutt .... -All mail sent to `example.FreeBSD.org` will be collected on `hub` under the same username instead of being sent directly to your host. +Mutt will automatically read and display the contents of the user mailbox in [.filename]#/var/mail#. +If no mails are found, Mutt will wait for commands from the user. +The example below shows Mutt displaying a list of messages: -The above information is handled by the DNS server. -The DNS record that carries mail routing information is the MX entry. -If no MX record exists, mail will be delivered directly to the host by way of its IP address. +image::mutt1.png[Mutt email client showing a list of messages] -The MX entry for `freefall.FreeBSD.org` at one time looked like this: +To read an email, select it using the cursor keys and press kbd:[Enter]. +An example of Mutt displaying email can be seen below: -[.programlisting] -.... -freefall MX 30 mail.crl.net -freefall MX 40 agora.rdrop.com -freefall MX 10 freefall.FreeBSD.org -freefall MX 20 who.cdrom.com -.... +image::mutt2.png[Mutt email client displaying an email] -`freefall` had many MX entries. -The lowest MX number is the host that receives mail directly, if available. -If it is not accessible for some reason, the next lower-numbered host will accept messages temporarily, and pass it along when a lower-numbered host becomes available. +Similar to man:mail[1], Mutt can be used to reply only to the sender of the message as well as to all recipients. +To reply only to the sender of the email, press kbd:[r]. +To send a group reply to the original sender as well as all the message recipients, press kbd:[g]. -Alternate MX sites should have separate Internet connections in order to be most useful. -Your ISP can provide this service. +[NOTE] +==== +By default, Mutt uses the man:vi[1] editor for creating and replying to emails. +Each user can customize this by creating or editing the [.filename]#.muttrc# in their home directory and setting the `editor` variable or by setting the `EDITOR` environment variable. +Refer to link:http://www.mutt.org/[http://www.mutt.org/] for more information about configuring Mutt. +==== -[[mail-domain]] -=== Mail for a Domain +To compose a new mail message, press kbd:[m]. +After a valid subject has been given, Mutt will start man:vi[1] so the email can be written. +Once the contents of the email are complete, save and quit from `vi`. +Mutt will resume, displaying a summary screen of the mail that is to be delivered. +In order to send the mail, press kbd:[y]. +An example of the summary screen can be seen below: -When configuring an MTA for a network, any mail sent to hosts in its domain should be diverted to the MTA so that users can receive their mail on the master mail server. +image::mutt3.png[Mutt email client showing the summary screen] -To make life easiest, a user account with the same _username_ should exist on both the MTA and the system with the MUA. -Use man:adduser[8] to create the user accounts. +Mutt contains extensive help which can be accessed from most of the menus by pressing kbd:[?]. +The top line also displays the keyboard shortcuts where appropriate. -The MTA must be the designated mail exchanger for each workstation on the network. -This is done in the DNS configuration with an MX record: - -[.programlisting] -.... -example.FreeBSD.org A 204.216.27.XX ; Workstation - MX 10 nevdull.FreeBSD.org ; Mailhost -.... +[[alpine-command]] +=== alpine -This will redirect mail for the workstation to the MTA no matter where the A record points. -The mail is sent to the MX host. +alpine is aimed at a beginner user, but also includes some advanced features. -This must be configured on a DNS server. -If the network does not run its own DNS server, talk to the ISP or DNS provider. +[WARNING] +==== +alpine has had several remote vulnerabilities discovered in the past, which allowed remote attackers to execute arbitrary code as users on the local system, by the action of sending a specially-prepared email. +While _known_ problems have been fixed, alpine code is written in an insecure style and the FreeBSD Security Officer believes there are likely to be other undiscovered vulnerabilities. +Users install alpine at their own risk. +==== -The following is an example of virtual email hosting. -Consider a customer with the domain `customer1.org`, where all the mail for `customer1.org` should be sent to `mail.myhost.com`. -The DNS entry should look like this: +The current version of alpine may be installed using the package:mail/alpine[] port. +Once the port has installed, alpine can be started by issuing the following command: -[.programlisting] +[source,shell] .... -customer1.org MX 10 mail.myhost.com +% alpine .... -An `A` record is _not_ needed for `customer1.org` in order to only handle email for that domain. -However, running `ping` against `customer1.org` will not work unless an `A` record exists for it. +The first time alpine runs, it displays a greeting page with a brief introduction, as well as a request from the alpine development team to send an anonymous email message allowing them to judge how many users are using their client. +To send this anonymous message, press kbd:[Enter]. +Alternatively, press kbd:[E] to exit the greeting without sending an anonymous message. +An example of the greeting page is shown below: -Tell the MTA which domains and/or hostnames it should accept mail for. -Either of the following will work for Sendmail: +image::pine1.png[alpine email client showing the greeting page] -* Add the hosts to [.filename]#/etc/mail/local-host-names# when using the `FEATURE(use_cw_file)`. -* Add a `Cwyour.host.com` line to [.filename]#/etc/sendmail.cf#. +The main menu is then presented, which can be navigated using the cursor keys. +This main menu provides shortcuts for the composing new mails, browsing mail directories, and administering address book entries. +Below the main menu, relevant keyboard shortcuts to perform functions specific to the task at hand are shown. -[[outgoing-only]] -== Setting Up to Send Only +The default directory opened by alpine is [.filename]#inbox#. +To view the message index, press kbd:[I], or select the [.guimenuitem]#MESSAGE INDEX# option shown below: -There are many instances where one may only want to send mail through a relay. -Some examples are: +image::pine2.png[alpine email client showing the default directory] -* The computer is a desktop machine that needs to use programs such as man:mail[1], using the ISP's mail relay. -* The computer is a server that does not handle mail locally, but needs to pass off all mail to a relay for processing. +The message index shows messages in the current directory and can be navigated by using the cursor keys. +Highlighted messages can be read by pressing kbd:[Enter]. -While any MTA is capable of filling this particular niche, it can be difficult to properly configure a full-featured MTA just to handle offloading mail. -Programs such as Sendmail and Postfix are overkill for this use. +image::pine3.png[alpine email client showing the message index] -Additionally, a typical Internet access service agreement may forbid one from running a "mail server". +In the screenshot below, a sample message is displayed by alpine. +Contextual keyboard shortcuts are displayed at the bottom of the screen. +An example of one of a shortcut is kbd:[r], which tells the MUA to reply to the current message being displayed. -The easiest way to fulfill those needs is to install the package:mail/ssmtp[] port: +image::pine4.png[alpine email client showing an email] -[source,shell] -.... -# cd /usr/ports/mail/ssmtp -# make install replace clean -.... +Replying to an email in alpine is done using the pico editor, which is installed by default with alpine. +pico makes it easy to navigate the message and is easier for novice users to use than man:vi[1] or man:mail[1]. +Once the reply is complete, the message can be sent by pressing kbd:[Ctrl+X]. +alpine will ask for confirmation before sending the message. -Once installed, package:mail/ssmtp[] can be configured with [.filename]#/usr/local/etc/ssmtp/ssmtp.conf#: +image::pine5.png[alpine email client showing the message compose window] -[.programlisting] -.... -root=yourrealemail@example.com -mailhub=mail.example.com -rewriteDomain=example.com -hostname=_HOSTNAME_ -.... +alpine can be customized using the [.guimenuitem]#SETUP# option from the main menu. -Use the real email address for `root`. -Enter the ISP's outgoing mail relay in place of `mail.example.com`. -Some ISPs call this the "outgoing mail server" or "SMTP server". +[[mail-advanced]] +== Advanced Topics -Make sure to disable Sendmail, including the outgoing mail service. -See <> for details. +This section covers more involved topics such as mail configuration and setting up mail for an entire domain. -package:mail/ssmtp[] has some other options available. Refer to the examples in [.filename]#/usr/local/etc/ssmtp# or the manual page of ssmtp for more information. +[[mail-config]] +=== Basic Configuration -Setting up ssmtp in this manner allows any software on the computer that needs to send mail to function properly, while not violating the ISP's usage policy or allowing the computer to be hijacked for spamming. +Out of the box, one can send email to external hosts as long as [.filename]#/etc/resolv.conf# is configured or the network has access to a configured DNS server. +To have email delivered to the MTA on the FreeBSD host, do one of the following: -[[SMTP-dialup]] -== Using Mail with a Dialup Connection +* Run a DNS server for the domain. +* Get mail delivered directly to the FQDN for the machine. -When using a static IP address, one should not need to adjust the default configuration. -Set the hostname to the assigned Internet name and Sendmail will do the rest. +In order to have mail delivered directly to a host, it must have a permanent static IP address, not a dynamic IP address. +If the system is behind a firewall, it must be configured to allow SMTP traffic. +To receive mail directly at a host, one of these two must be configured: -When using a dynamically assigned IP address and a dialup PPP connection to the Internet, one usually has a mailbox on the ISP's mail server. -In this example, the ISP's domain is `example.net`, the user name is `user`, the hostname is `bsd.home`, and the ISP has allowed `relay.example.net` as a mail relay. +* Make sure that the lowest-numbered MX record in DNS points to the host's static IP address. +* Make sure there is no MX entry in the DNS for the host. + +Either of the above will allow mail to be received directly at the host. -In order to retrieve mail from the ISP's mailbox, install a retrieval agent from the Ports Collection. package:mail/fetchmail[] is a good choice as it supports many different protocols. -Usually, the ISP will provide POP. -When using user PPP, email can be automatically fetched when an Internet connection is established with the following entry in [.filename]#/etc/ppp/ppp.linkup#: +Try this: -[.programlisting] +[source,shell] .... -MYADDR: -!bg su user -c fetchmail +# hostname .... -When using Sendmail to deliver mail to non-local accounts, configure Sendmail to process the mail queue as soon as the Internet connection is established. -To do this, add this line after the above `fetchmail` entry in [.filename]#/etc/ppp/ppp.linkup#: +The output should be similar to the following: [.programlisting] .... - !bg su user -c "sendmail -q" +example.FreeBSD.org .... -In this example, there is an account for `user` on `bsd.home`. -In the home directory of `user` on `bsd.home`, create a [.filename]#.fetchmailrc# which contains this line: - -[.programlisting] +[source,shell] .... -poll example.net protocol pop3 fetchall pass MySecret +# host example.FreeBSD.org .... -This file should not be readable by anyone except `user` as it contains the password `MySecret`. - -In order to send mail with the correct `from:` header, configure Sendmail to use mailto:user@example.net[user@example.net] rather than mailto:user@bsd.home[user@bsd.home] and to send all mail via `relay.example.net`, allowing quicker mail transmission. - -The following [.filename]#.mc# should suffice: +The output should be similar to the following: [.programlisting] .... -VERSIONID(`bsd.home.mc version 1.0') -OSTYPE(bsd4.4)dnl -FEATURE(nouucp)dnl -MAILER(local)dnl -MAILER(smtp)dnl -Cwlocalhost -Cwbsd.home -MASQUERADE_AS(`example.net')dnl -FEATURE(allmasquerade)dnl -FEATURE(masquerade_envelope)dnl -FEATURE(nocanonify)dnl -FEATURE(nodns)dnl -define(`SMART_HOST', `relay.example.net') -Dmbsd.home -define(`confDOMAIN_NAME',`bsd.home')dnl -define(`confDELIVERY_MODE',`deferred')dnl -.... - -Refer to the previous section for details of how to convert this file into the [.filename]#sendmail.cf# format. -Do not forget to restart Sendmail after updating [.filename]#sendmail.cf#. +example.FreeBSD.org has address 204.216.27.XX +.... -[[SMTP-Auth]] -== SMTP Authentication +In this example, mail sent directly to mailto:yourlogin@example.FreeBSD.org[yourlogin@example.FreeBSD.org] should work without problems, assuming man:dma[8] or man:sendmail[8] are running correctly on `example.FreeBSD.org`. -Configuring SMTP authentication on the MTA provides a number of benefits. -SMTP authentication adds a layer of security to Sendmail, and provides mobile users who switch hosts the ability to use the same MTA without the need to reconfigure their mail client's settings each time. - -[.procedure] -. Install package:security/cyrus-sasl2[] from the Ports Collection. This port supports a number of compile-time options. For the SMTP authentication method demonstrated in this example, make sure that `LOGIN` is not disabled. -. After installing package:security/cyrus-sasl2[], edit [.filename]#/usr/local/lib/sasl2/Sendmail.conf#, or create it if it does not exist, and add the following line: -+ -[.programlisting] -.... -pwcheck_method: saslauthd -.... +For this example: -. Next, install package:security/cyrus-sasl2-saslauthd[] and add the following line to [.filename]#/etc/rc.conf#: -+ -[.programlisting] -.... -saslauthd_enable="YES" -.... -+ -Finally, start the saslauthd daemon: -+ [source,shell] .... -# service saslauthd start -.... -+ -This daemon serves as a broker for Sendmail to authenticate against the FreeBSD man:passwd[5] database. -This saves the trouble of creating a new set of usernames and passwords for each user that needs to use SMTP authentication, and keeps the login and mail password the same. -. Next, edit [.filename]#/etc/make.conf# and add the following lines: -+ -[.programlisting] -.... -SENDMAIL_CFLAGS=-I/usr/local/include/sasl -DSASL -SENDMAIL_LDADD=/usr/local/lib/libsasl2.so -.... -+ -These lines provide Sendmail the proper configuration options for linking to package:cyrus-sasl2[] at compile time. -Make sure that package:cyrus-sasl2[] has been installed before recompiling Sendmail. -. Recompile Sendmail by executing the following commands: -+ -[source,shell] -.... -# cd /usr/src/lib/libsmutil -# make cleandir && make obj && make -# cd /usr/src/lib/libsm -# make cleandir && make obj && make -# cd /usr/src/usr.sbin/sendmail -# make cleandir && make obj && make && make install -.... -+ -This compile should not have any problems if [.filename]#/usr/src# has not changed extensively and the shared libraries it needs are available. -. After Sendmail has been compiled and reinstalled, edit [.filename]#/etc/mail/freebsd.mc# or the local [.filename]#.mc#. Many administrators choose to use the output from man:hostname[1] as the name of [.filename]#.mc# for uniqueness. Add these lines: -+ -[.programlisting] -.... -dnl set SASL options -TRUST_AUTH_MECH(`GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN')dnl -define(`confAUTH_MECHANISMS', `GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN')dnl +# host example.FreeBSD.org .... -+ -These options configure the different methods available to Sendmail for authenticating users. -To use a method other than pwcheck, refer to the Sendmail documentation. -. Finally, run man:make[1] while in [.filename]#/etc/mail#. That will run the new [.filename]#.mc# and create a [.filename]#.cf# named either [.filename]#freebsd.cf# or the name used for the local [.filename]#.mc#. Then, run `make install restart`, which will copy the file to [.filename]#sendmail.cf#, and properly restart Sendmail. For more information about this process, refer to [.filename]#/etc/mail/Makefile#. - -To test the configuration, use a MUA to send a test message. -For further investigation, set the `LogLevel` of Sendmail to `13` and watch [.filename]#/var/log/maillog# for any errors. - -For more information, refer to http://www.sendmail.org/~ca/email/auth.html[SMTP authentication]. - -[[mail-agents]] -== Mail User Agents - -A MUA is an application that is used to send and receive email. -As email "evolves" and becomes more complex, MUAs are becoming increasingly powerful and provide users increased functionality and flexibility. -The `mail` category of the FreeBSD Ports Collection contains numerous MUAs. -These include graphical email clients such as Evolution or Balsa and console based clients such as mutt or alpine. - -[[mail-command]] -=== `mail` - -man:mail[1] is the default MUA installed with FreeBSD. It is a console based MUA that offers the basic functionality required to send and receive text-based email. -It provides limited attachment support and can only access local mailboxes. -Although `mail` does not natively support interaction with POP or IMAP servers, these mailboxes may be downloaded to a local [.filename]#mbox# using an application such as fetchmail. +The output should be similar to the following: -In order to send and receive email, run `mail`: - -[source,shell] +[.programlisting] .... -% mail +example.FreeBSD.org has address 204.216.27.XX +example.FreeBSD.org mail is handled (pri=10) by nevdull.FreeBSD.org .... -The contents of the user's mailbox in [.filename]#/var/mail# are automatically read by `mail`. -Should the mailbox be empty, the utility exits with a message indicating that no mail could be found. -If mail exists, the application interface starts, and a list of messages will be displayed. -Messages are automatically numbered, as can be seen in the following example: +All mail sent to `example.FreeBSD.org` will be collected on `hub` under the same username instead of being sent directly to your host. -[source,shell] -.... -Mail version 8.1 6/6/93. Type ? for help. -"/var/mail/marcs": 3 messages 3 new ->N 1 root@localhost Mon Mar 8 14:05 14/510 "test" - N 2 root@localhost Mon Mar 8 14:05 14/509 "user account" - N 3 root@localhost Mon Mar 8 14:05 14/509 "sample" -.... +The above information is handled by the DNS server. +The DNS record that carries mail routing information is the link:https://en.wikipedia.org/wiki/MX_record[mail exchanger record (MX record)]. +If no MX record exists, mail will be delivered directly to the host by way of its IP address. -Messages can now be read by typing kbd:[t] followed by the message number. -This example reads the first email: +The MX entry for `freefall.FreeBSD.org` at one time looked like this: -[source,shell] +[.programlisting] .... -& t 1 -Message 1: -From root@localhost Mon Mar 8 14:05:52 2004 -X-Original-To: marcs@localhost -Delivered-To: marcs@localhost -To: marcs@localhost -Subject: test -Date: Mon, 8 Mar 2004 14:05:52 +0200 (SAST) -From: root@localhost (Charlie Root) - -This is a test message, please reply if you receive it. +freefall MX 30 mail.crl.net +freefall MX 40 agora.rdrop.com +freefall MX 10 freefall.FreeBSD.org +freefall MX 20 who.cdrom.com .... -As seen in this example, the message will be displayed with full headers. -To display the list of messages again, press kbd:[h]. +`freefall` had many MX entries. +The lowest MX number is the host that receives mail directly, if available. +If it is not accessible for some reason, the next lower-numbered host will accept messages temporarily, and pass it along when a lower-numbered host becomes available. -If the email requires a reply, press either kbd:[R] or kbd:[r] `mail` keys. -kbd:[R] instructs `mail` to reply only to the sender of the email, while kbd:[r] replies to all other recipients of the message. -These commands can be suffixed with the mail number of the message to reply to. -After typing the response, the end of the message should be marked by a single kbd:[.] on its own line. -An example can be seen below: +Alternate MX sites should have separate Internet connections in order to be most useful. +Your ISP can provide this service. -[source,shell] -.... -& R 1 -To: root@localhost -Subject: Re: test +[[mail-domain]] +=== Mail for a Domain -Thank you, I did get your email. -. -EOT -.... +When configuring an MTA for a network, any mail sent to hosts in its domain should be diverted to the MTA so that users can receive their mail on the master mail server. -In order to send a new email, press kbd:[m], followed by the recipient email address. -Multiple recipients may be specified by separating each address with the kbd:[,] delimiter. -The subject of the message may then be entered, followed by the message contents. -The end of the message should be specified by putting a single kbd:[.] on its own line. +To make life easiest, a user account with the same _username_ should exist on both the MTA and the system with the MUA. +Use man:adduser[8] to create the user accounts. -[source,shell] -.... -& mail root@localhost -Subject: I mastered mail +The MTA must be the designated mail exchanger for each workstation on the network. +This is done in the DNS configuration with an MX record: -Now I can send and receive email using mail ... :) -. -EOT +[.programlisting] +.... +example.FreeBSD.org A 204.216.27.XX ; Workstation + MX 10 nevdull.FreeBSD.org ; Mailhost .... -While using `mail`, press kbd:[?] to display help at any time. -Refer to man:mail[1] for more help on how to use `mail`. - -[NOTE] -==== -man:mail[1] was not designed to handle attachments and thus deals with them poorly. -Newer MUAs handle attachments in a more intelligent way. -Users who prefer to use `mail` may find the package:converters/mpack[] port to be of considerable use. -==== - -[[mutt-command]] -=== mutt +This will redirect mail for the workstation to the MTA no matter where the A record points. +The mail is sent to the MX host. -mutt is a powerful MUA, with many features, including: +This must be configured on a DNS server. +If the network does not run its own DNS server, talk to the ISP or DNS provider. -* The ability to thread messages. -* PGP support for digital signing and encryption of email. -* MIME support. -* Maildir support. -* Highly customizable. +The following is an example of virtual email hosting. -Refer to http://www.mutt.org[http://www.mutt.org] for more information on mutt. +Consider a customer with the domain `customer1.org`, where all the mail for `customer1.org` should be sent to `mail.myhost.com`. -mutt may be installed using the package:mail/mutt[] port. -After the port has been installed, mutt can be started by issuing the following command: +The DNS entry should look like this: -[source,shell] +[.programlisting] .... -% mutt +customer1.org MX 10 mail.myhost.com .... -mutt will automatically read and display the contents of the user mailbox in [.filename]#/var/mail#. -If no mails are found, mutt will wait for commands from the user. -The example below shows mutt displaying a list of messages: - -image::mutt1.png[mutt email client showing a list of messages] - -To read an email, select it using the cursor keys and press kbd:[Enter]. -An example of mutt displaying email can be seen below: - -image::mutt2.png[mutt email client displaying an email] - -Similar to man:mail[1], mutt can be used to reply only to the sender of the message as well as to all recipients. -To reply only to the sender of the email, press kbd:[r]. -To send a group reply to the original sender as well as all the message recipients, press kbd:[g]. +An `A` record is _not_ needed for `customer1.org` in order to only handle email for that domain. +However, running `ping` against `customer1.org` will not work unless an `A` record exists for it. -[NOTE] -==== -By default, mutt uses the man:vi[1] editor for creating and replying to emails. -Each user can customize this by creating or editing the [.filename]#.muttrc# in their home directory and setting the `editor` variable or by setting the `EDITOR` environment variable. -Refer to http://www.mutt.org/[http://www.mutt.org/] for more information about configuring mutt. -==== +Tell the MTA which domains and/or hostnames it should accept mail for. +Either of the following will work for Sendmail: -To compose a new mail message, press kbd:[m]. -After a valid subject has been given, mutt will start man:vi[1] so the email can be written. -Once the contents of the email are complete, save and quit from `vi`. -mutt will resume, displaying a summary screen of the mail that is to be delivered. -In order to send the mail, press kbd:[y]. -An example of the summary screen can be seen below: +* Add the hosts to [.filename]#/etc/mail/local-host-names# when using the `FEATURE(use_cw_file)`. +* Add a `Cwyour.host.com` line to [.filename]#/etc/sendmail.cf#. -image::mutt3.png[mutt email client showing the summary screen] +[[outgoing-only]] +=== Setting Up to Send Only -mutt contains extensive help which can be accessed from most of the menus by pressing kbd:[?]. -The top line also displays the keyboard shortcuts where appropriate. +There are many instances where one may only want to send mail through a relay. +Some examples are: -[[alpine-command]] -=== alpine +* The computer is a desktop machine that needs to use programs such as man:mail[1], using the ISP's mail relay. +* The computer is a server that does not handle mail locally, but needs to pass off all mail to a relay for processing. -alpine is aimed at a beginner user, but also includes some advanced features. +While any MTA is capable of filling this particular niche, it can be difficult to properly configure a full-featured MTA just to handle offloading mail. +Programs such as Sendmail and Postfix are overkill for this use. -[WARNING] -==== -alpine has had several remote vulnerabilities discovered in the past, which allowed remote attackers to execute arbitrary code as users on the local system, by the action of sending a specially-prepared email. -While _known_ problems have been fixed, alpine code is written in an insecure style and the FreeBSD Security Officer believes there are likely to be other undiscovered vulnerabilities. -Users install alpine at their own risk. -==== +Additionally, a typical Internet access service agreement may forbid one from running a "mail server". -The current version of alpine may be installed using the package:mail/alpine[] port. -Once the port has installed, alpine can be started by issuing the following command: +The easiest way to fulfill those needs is to install the package:mail/ssmtp[] port: [source,shell] .... -% alpine +# cd /usr/ports/mail/ssmtp +# make install replace clean .... -The first time alpine runs, it displays a greeting page with a brief introduction, as well as a request from the alpine development team to send an anonymous email message allowing them to judge how many users are using their client. -To send this anonymous message, press kbd:[Enter]. -Alternatively, press kbd:[E] to exit the greeting without sending an anonymous message. -An example of the greeting page is shown below: - -image::pine1.png[alpine email client showing the greeting page] - -The main menu is then presented, which can be navigated using the cursor keys. -This main menu provides shortcuts for the composing new mails, browsing mail directories, and administering address book entries. -Below the main menu, relevant keyboard shortcuts to perform functions specific to the task at hand are shown. - -The default directory opened by alpine is [.filename]#inbox#. -To view the message index, press kbd:[I], or select the [.guimenuitem]#MESSAGE INDEX# option shown below: - -image::pine2.png[alpine email client showing the default directory] - -The message index shows messages in the current directory and can be navigated by using the cursor keys. -Highlighted messages can be read by pressing kbd:[Enter]. - -image::pine3.png[alpine email client showing the message index] - -In the screenshot below, a sample message is displayed by alpine. -Contextual keyboard shortcuts are displayed at the bottom of the screen. -An example of one of a shortcut is kbd:[r], which tells the MUA to reply to the current message being displayed. - -image::pine4.png[alpine email client showing an email] +Once installed, package:mail/ssmtp[] can be configured with [.filename]#/usr/local/etc/ssmtp/ssmtp.conf#: -Replying to an email in alpine is done using the pico editor, which is installed by default with alpine. -pico makes it easy to navigate the message and is easier for novice users to use than man:vi[1] or man:mail[1]. -Once the reply is complete, the message can be sent by pressing kbd:[Ctrl+X]. -alpine will ask for confirmation before sending the message. +[.programlisting] +.... +root=yourrealemail@example.com +mailhub=mail.example.com +rewriteDomain=example.com +hostname=_HOSTNAME_ +.... -image::pine5.png[alpine email client showing the message compose window] +Use the real email address for `root`. +Enter the ISP's outgoing mail relay in place of `mail.example.com`. +Some ISPs call this the "outgoing mail server" or "SMTP server". -alpine can be customized using the [.guimenuitem]#SETUP# option from the main menu. -Consult http://www.washington.edu/alpine/[http://www.washington.edu/alpine/] for more information. +Make sure to disable Sendmail, including the outgoing mail service. +See <> for details. -[[mail-fetchmail]] -== Using fetchmail +package:mail/ssmtp[] has some other options available. Refer to the examples in [.filename]#/usr/local/etc/ssmtp# or the manual page of ssmtp for more information. -fetchmail is a full-featured IMAP and POP client. -It allows users to automatically download mail from remote IMAP and POP servers and save it into local mailboxes where it can be accessed more easily. -fetchmail can be installed using the package:mail/fetchmail[] port, and offers various features, including: +Setting up ssmtp in this manner allows any software on the computer that needs to send mail to function properly, while not violating the ISP's usage policy or allowing the computer to be hijacked for spamming. -* Support for the POP3, APOP, KPOP, IMAP, ETRN and ODMR protocols. -* Ability to forward mail using SMTP, which allows filtering, forwarding, and aliasing to function normally. -* May be run in daemon mode to check periodically for new messages. -* Can retrieve multiple mailboxes and forward them, based on configuration, to different local users. +[[SMTP-Auth]] +=== SMTP Authentication in Sendmail -This section explains some of the basic features of fetchmail. -This utility requires a [.filename]#.fetchmailrc# configuration in the user's home directory in order to run correctly. -This file includes server information as well as login credentials. -Due to the sensitive nature of the contents of this file, it is advisable to make it readable only by the user, with the following command: +Configuring SMTP authentication on the MTA provides a number of benefits. +SMTP authentication adds a layer of security to Sendmail, and provides mobile users who switch hosts the ability to use the same MTA without the need to reconfigure their mail client's settings each time. -[source,shell] -.... -% chmod 600 .fetchmailrc -.... +Install package:security/cyrus-sasl2[] from the Ports Collection. +This port supports a number of compile-time options. +For the SMTP authentication method demonstrated in this example, make sure that `LOGIN` is not disabled. -The following [.filename]#.fetchmailrc# serves as an example for downloading a single user mailbox using POP. -It tells fetchmail to connect to `example.com` using a username of `joesoap` and a password of `XXX`. -This example assumes that the user `joesoap` exists on the local system. +After installing package:security/cyrus-sasl2[], edit [.filename]#/usr/local/lib/sasl2/Sendmail.conf#, or create it if it does not exist, and add the following line: [.programlisting] .... -poll example.com protocol pop3 username "joesoap" password "XXX" +pwcheck_method: saslauthd .... -The next example connects to multiple POP and IMAP servers and redirects to different local usernames where applicable: +Next, install package:security/cyrus-sasl2-saslauthd[] and add execute the following command: -[.programlisting] +[source,shell] .... -poll example.com proto pop3: -user "joesoap", with password "XXX", is "jsoap" here; -user "andrea", with password "XXXX"; -poll example2.net proto imap: -user "john", with password "XXXXX", is "myth" here; +# sysrc saslauthd_enable="YES" .... -fetchmail can be run in daemon mode by running it with `-d`, followed by the interval (in seconds) that fetchmail should poll servers listed in [.filename]#.fetchmailrc#. -The following example configures fetchmail to poll every 600 seconds: +Finally, start the saslauthd daemon: [source,shell] .... -% fetchmail -d 600 +# service saslauthd start .... -More information on fetchmail can be found at http://www.fetchmail.info/[http://www.fetchmail.info/]. - -[[mail-procmail]] -== Using procmail +This daemon serves as a broker for Sendmail to authenticate against the FreeBSD man:passwd[5] database. +This saves the trouble of creating a new set of usernames and passwords for each user that needs to use SMTP authentication, and keeps the login and mail password the same. -procmail is a powerful application used to filter incoming mail. -It allows users to define "rules" which can be matched to incoming mails to perform specific functions or to reroute mail to alternative mailboxes or email addresses. -procmail can be installed using the package:mail/procmail[] port. -Once installed, it can be directly integrated into most MTAs. -Consult the MTA documentation for more information. -Alternatively, procmail can be integrated by adding the following line to a [.filename]#.forward# in the home directory of the user: +Next, edit [.filename]#/etc/make.conf# and add the following lines: [.programlisting] .... -"|exec /usr/local/bin/procmail || exit 75" +SENDMAIL_CFLAGS=-I/usr/local/include/sasl -DSASL +SENDMAIL_LDADD=/usr/local/lib/libsasl2.so .... -The following section displays some basic procmail rules, as well as brief descriptions of what they do. -Rules must be inserted into a [.filename]#.procmailrc#, which must reside in the user's home directory. - -The majority of these rules can be found in man:procmailex[5]. +These lines provide Sendmail the proper configuration options for linking to package:cyrus-sasl2[] at compile time. +Make sure that package:cyrus-sasl2[] has been installed before recompiling Sendmail. -To forward all mail from mailto:user@example.com[user@example.com] to an external address of mailto:goodmail@example2.com[goodmail@example2.com]: +Recompile Sendmail by executing the following commands: -[.programlisting] +[source,shell] .... -:0 -* ^From.*user@example.com -! goodmail@example2.com +# cd /usr/src/lib/libsmutil +# make cleandir && make obj && make +# cd /usr/src/lib/libsm +# make cleandir && make obj && make +# cd /usr/src/usr.sbin/sendmail +# make cleandir && make obj && make && make install .... -To forward all mails shorter than 1000 bytes to an external address of mailto:goodmail@example2.com[goodmail@example2.com]: +This compile should not have any problems if [.filename]#/usr/src# has not changed extensively and the shared libraries it needs are available. -[.programlisting] -.... -:0 -* < 1000 -! goodmail@example2.com -.... +After Sendmail has been compiled and reinstalled, edit [.filename]#/etc/mail/freebsd.mc# or the local [.filename]#.mc#. +Many administrators choose to use the output from man:hostname[1] as the name of [.filename]#.mc# for uniqueness. -To send all mail sent to mailto:alternate@example.com[alternate@example.com] to a mailbox called [.filename]#alternate#: +Add these lines: [.programlisting] .... -:0 -* ^TOalternate@example.com -alternate +dnl set SASL options +TRUST_AUTH_MECH(`GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN')dnl +define(`confAUTH_MECHANISMS', `GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN')dnl .... -To send all mail with a subject of "Spam" to [.filename]#/dev/null#: +These options configure the different methods available to Sendmail for authenticating users. +To use a method other than pwcheck, refer to the Sendmail documentation. -[.programlisting] -.... -:0 -^Subject:.*Spam -/dev/null -.... +Finally, run man:make[1] while in [.filename]#/etc/mail#. +That will run the new [.filename]#.mc# and create a [.filename]#.cf# named either [.filename]#freebsd.cf# or the name used for the local [.filename]#.mc#. -A useful recipe that parses incoming `FreeBSD.org` mailing lists and places each list in its own mailbox: +Then, run `make install restart`, which will copy the file to [.filename]#sendmail.cf#, and properly restart Sendmail. -[.programlisting] -.... -:0 -* ^Sender:.owner-freebsd-\/[^@]+@FreeBSD.ORG -{ - LISTNAME=${MATCH} - :0 - * LISTNAME??^\/[^@]+ - FreeBSD-${MATCH} -} -.... +For more information about this process, refer to [.filename]#/etc/mail/Makefile#. + +To test the configuration, use a MUA to send a test message. +For further investigation, set the `LogLevel` of Sendmail to `13` and watch [.filename]#/var/log/maillog# for any errors. + +For more information, refer to http://www.sendmail.org/~ca/email/auth.html[SMTP authentication].