Update: This does not work!! FreeBSD 6.1 sendmail does not include TLS (GNU TLS or SSL), so you need to recompile sendmail with TLS support. Easier still is to install Exim 4 from ports that supports all we need.
I run a FreeBSD 6.1 box at home and want to send emails from it by using GMail as my mail relay (smarthost). GMail provides secure mail relaying by using SMTP AUTH and TLS. Hence this setup will work for DSL users on a dynamic IP addresses as well as mobile users.
Here is how you go about setting up all this:
Step 0: DNS settings
If you don't have a fully qualified DNS entry for your box, sendmail will have trouble starting up. I have a Dynamic DNS domain mithila.ath.cx and it's wild carded, ie. *.mithila.ath.cx will all point to mithila.ath.cx. My /etc/resolv.conf looks like this:
search mithila.ath.cx
nameserver 208.67.222.222
nameserver 208.67.220.220
I use
OpenDNS as my servers because my ISP DNS servers are unreliable.
Step 1: Editing freebsd.mc
Edit /etc/mail/freebsd.mc and add the following lines to the bottom of the file:
define(`SMART_HOST',`smtp.gmail.com')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
FEATURE(`authinfo',`hash /etc/mail/auth/client-info')dnl
define(`CERT_DIR', `MAIL_SETTINGS_DIR`'certs')
define(`confCACERT_PATH', `CERT_DIR')
define(`confCACERT', `CERT_DIR/CAcert.pem')
define(`confSERVER_CERT', `CERT_DIR/mycert.pem')
define(`confSERVER_KEY', `CERT_DIR/mykey.pem')
define(`confCLIENT_CERT', `CERT_DIR/mycert.pem')
define(`confCLIENT_KEY', `CERT_DIR/mykey.pem')
Step 2: Create client-info with your gmail username/password
[root@mithila /etc/mail] mkdir /etc/mail/auth
[root@mithila /etc/mail] touch /etc/mail/auth/client-info
The contents of
/etc/mail/auth/client-info is a single line:
[root@mithila /etc/mail/auth]# cat client-info
AuthInfo:smtp.gmail.com "U:root" "I:GMAILUSER@gmail.com" "P:PASSWORD"
Replace GMAILUSER with your gmail username and PASSWORD with your gmail password. Note that you are storing your gmail password in clear text, so please take the necessary precautions.
To create the client-info hash, run the following:
[root@mithila /etc/mail/auth] makemap hash client-info < client-info
Finish this step by fixing the ownership and permission on your files (sendmail is picky about this):
[root@mithila /etc/mail/auth] chown -R root:wheel /etc/mail/auth
[root@mithila /etc/mail/auth] chmod 700 /etc/mail/auth
[root@mithila /etc/mail/auth] chmod 600 /etc/mail/auth/*
Step 3: Creating SSL certs
The OpenBSD
starttls(8) manpage has an excellent walkthrough for creating an SSL certs. Following is just a repeat of the relevant bits of the manpage.
[root@mithila /etc/mail] mkdir /etc/mail/certs
[root@mithila /etc/mail] cd certs
[root@mithila /etc/mail/certs] openssl dsaparam 1024 -out dsa1024.pem
[root@mithila /etc/mail/certs] openssl req -x509 -nodes -days 3650 -newkey dsa:dsa1024.pem -out /etc/mail/certs/mycert.pem -keyout /etc/mail/certs/mykey.pem
[root@mithila /etc/mail/certs] ln -s /etc/mail/certs/mycert.pem /etc/mail/certs/CAcert.pem
[root@mithila /etc/mail/certs] openssl req -x509 -new -days 3650 -key /etc/mail/certs/mykey.pem -out /etc/mail/certs/mycert.pem
Remove temporary files and fix ownership and permissions:
[root@mithila /etc/mail/certs] rm dsa1024.pem
[root@mithila /etc/mail/certs] chown -R root:wheel .
[root@mithila /etc/mail/certs] chmod 700 .
[root@mithila /etc/mail/certs] chmod 600 *
Step 4: Create new sendmail.cf
[root@mithila /etc/mail] make; make install
[root@mithila /etc/mail] /etc/rc.d/sendmail stop
[root@mithila /etc/mail] /etc/rc.d/sendmail start
Watch /var/log/maillog for errors when sendmail is restarted.
Step 5: send test email
[rsubr@mithila ~] mail -s 'MAILTEST' GMAILUSER@gmail.com < /etc/motd
[rsubr@mithila ~] mail -s 'MAILTEST' username@domain.com < /etc/motd
Watch /var/log/maillog for errors. That's all folks!
Issues
Ensure that your box is capable of resolving MX records for domains.
[rsubr@mithila ~] dig -t mx gmail.com
For some strange reason, my DSL router did not want to resolve mx records, and sendmail barfed. Using the right DNS servers in /etc/resolv.conf should do the trick, or you could just run named and point DNS to localhost. I chose the former, and since my ISP (Airtel) has unreliable DNS servers, I use the
OpenDNS servers 208.67.222.222, 208.67.220.220.