GMail as smarthost for FreeBSD-6.1 Sendmail

Update: This does not work!! FreeBSD 6.1 sendmail does not include TLS (GNU TLS or SSL), so you need to recompile sendmail with TLS support. Easier still is to install Exim 4 from ports that supports all we need.


I run a FreeBSD 6.1 box at home and want to send emails from it by using GMail as my mail relay (smarthost). GMail provides secure mail relaying by using SMTP AUTH and TLS. Hence this setup will work for DSL users on a dynamic IP addresses as well as mobile users.

Here is how you go about setting up all this:

Step 0: DNS settings

If you don't have a fully qualified DNS entry for your box, sendmail will have trouble starting up. I have a Dynamic DNS domain mithila.ath.cx and it's wild carded, ie. *.mithila.ath.cx will all point to mithila.ath.cx. My /etc/resolv.conf looks like this:

search mithila.ath.cx

nameserver 208.67.222.222

nameserver 208.67.220.220

I use OpenDNS as my servers because my ISP DNS servers are unreliable.

Step 1: Editing freebsd.mc

Edit /etc/mail/freebsd.mc and add the following lines to the bottom of the file:

define(`SMART_HOST',`smtp.gmail.com')dnl

define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

FEATURE(`authinfo',`hash /etc/mail/auth/client-info')dnl

define(`CERT_DIR', `MAIL_SETTINGS_DIR`'certs')

define(`confCACERT_PATH', `CERT_DIR')

define(`confCACERT', `CERT_DIR/CAcert.pem')

define(`confSERVER_CERT', `CERT_DIR/mycert.pem')

define(`confSERVER_KEY', `CERT_DIR/mykey.pem')

define(`confCLIENT_CERT', `CERT_DIR/mycert.pem')

define(`confCLIENT_KEY', `CERT_DIR/mykey.pem')

Step 2: Create client-info with your gmail username/password

[root@mithila /etc/mail] mkdir /etc/mail/auth

[root@mithila /etc/mail] touch /etc/mail/auth/client-info

The contents of /etc/mail/auth/client-info is a single line:

[root@mithila /etc/mail/auth]# cat client-info

AuthInfo:smtp.gmail.com "U:root" "I:GMAILUSER@gmail.com" "P:PASSWORD"

Replace GMAILUSER with your gmail username and PASSWORD with your gmail password. Note that you are storing your gmail password in clear text, so please take the necessary precautions.

To create the client-info hash, run the following:

[root@mithila /etc/mail/auth] makemap hash client-info < client-info

Finish this step by fixing the ownership and permission on your files (sendmail is picky about this):

[root@mithila /etc/mail/auth] chown -R root:wheel /etc/mail/auth

[root@mithila /etc/mail/auth] chmod 700 /etc/mail/auth

[root@mithila /etc/mail/auth] chmod 600 /etc/mail/auth/*

Step 3: Creating SSL certs

The OpenBSD starttls(8) manpage has an excellent walkthrough for creating an SSL certs. Following is just a repeat of the relevant bits of the manpage.

[root@mithila /etc/mail] mkdir /etc/mail/certs

[root@mithila /etc/mail] cd certs

[root@mithila /etc/mail/certs] openssl dsaparam 1024 -out dsa1024.pem

[root@mithila /etc/mail/certs] openssl req -x509 -nodes -days 3650 -newkey dsa:dsa1024.pem -out /etc/mail/certs/mycert.pem -keyout /etc/mail/certs/mykey.pem

[root@mithila /etc/mail/certs] ln -s /etc/mail/certs/mycert.pem /etc/mail/certs/CAcert.pem

[root@mithila /etc/mail/certs] openssl req -x509 -new -days 3650 -key /etc/mail/certs/mykey.pem -out /etc/mail/certs/mycert.pem

Remove temporary files and fix ownership and permissions:

[root@mithila /etc/mail/certs] rm dsa1024.pem

[root@mithila /etc/mail/certs] chown -R root:wheel .

[root@mithila /etc/mail/certs] chmod 700 .

[root@mithila /etc/mail/certs] chmod 600 *

Step 4: Create new sendmail.cf

[root@mithila /etc/mail] make; make install

[root@mithila /etc/mail] /etc/rc.d/sendmail stop

[root@mithila /etc/mail] /etc/rc.d/sendmail start 

Watch /var/log/maillog for errors when sendmail is restarted.

Step 5: send test email

[rsubr@mithila ~] mail -s 'MAILTEST' GMAILUSER@gmail.com < /etc/motd

[rsubr@mithila ~] mail -s 'MAILTEST' username@domain.com < /etc/motd

Watch /var/log/maillog for errors. That's all folks!

Issues

Ensure that your box is capable of resolving MX records for domains.

[rsubr@mithila ~] dig -t mx gmail.com

For some strange reason, my DSL router did not want to resolve mx records, and sendmail barfed. Using the right DNS servers in /etc/resolv.conf should do the trick, or you could just run named and point DNS to localhost. I chose the former, and since my ISP (Airtel) has unreliable DNS servers, I use the OpenDNS servers 208.67.222.222, 208.67.220.220.