3. Using it With Your Mail Software

This section describes setting up your POP client software to use the ssh forwarded connection. It's primary focus is fetchmail (ESR's excellent mail-retrieval and forwarding utility), since that is the most flexible software I have found for dealing with POP. fetchmail can be found at http://www.tuxedo.org/~esr/fetchmail/. It will do you a great service to read the excellent documentation that comes with fetchmail.

3.1 Setting up fetchmail

The following is my .fetchmailrc

---

defaults
        user msingh is manish
        no rewrite

poll localhost with protocol pop3 and port 11110:
        preconnect "ssh -C -f msingh@popserver -L 11110:popserver:110 sleep 5"
        password foobar;

---

Pretty simple, huh? fetchmail has a wealth of commands, but the key ones are the preconnect line and the poll option.

We're not connecting directly to the POP server, but instead localhost and port 11110. The preconnect does the forwarding each time fetchmail is run, leaving open the connection for 5 seconds, so fetchmail can make it's own connect. The rest fetchmail does itself.

So each time you run fetchmail, you're prompted for your ssh password for authentication. If you run fetchmail in the background (like I do), it's inconvenient to have to do that. Which brings us to the next section.

3.2 Automating it all

ssh can authenticate using many methods. One of these is an RSA public/private key pair. You can generate an authentication key for your account using ssh-keygen. An authetication key can have a passphrase associated with it, or the passphase can be blank. Whether you want a passphrase depends on how secure you think the account you are using locally is.

If you think your machine is secure, go ahead and have a blank passpharase. Then the above .fetchmailrc works just by running fetchmail. You can then run fetchmail in daemon mode when you dial up and mail is fetched automatically. You're done.

However, if you think you need a passphrase, things get more complex. ssh can run under control of an agent, which can register keys and authenticate whatever ssh connections are made under it. So I have this script getmail.sh:

---

#!/bin/sh
ssh-add
while true; do fetchmail --syslog --invisible; sleep 5m; done

---

When I dialup, I run:

$ ssh-agent getmail.sh

This prompts me for my passphrase once, then checks mail every 5 minutes. When the dialup connection is closed, I terminate ssh-agent. (This is automated in my ip-up and ip-down scripts)

3.3 Not using fetchmail

What if I can't/don't want to use fetchmail? Pine, Netscape, and some other clients have their own POP mechanisms. First, consider using fetchmail! It's far more flexible, and mail clients shouldn't be doing that kind of stuff anyway. Both Pine and Netscape can be configured to use local mail systems.

But if you must, unless your client has a preconnect feature like fetchmail, you're going to have to keep the ssh port forward active for the entire time you're connected. Which means using sleep 100000000 to keep the connection alive. This might not go over well with your network admins.

Secondly, some clients (like Netscape) have the port number hardcoded to 110. So you need to be root to do port forwarding from privledged ports. This is also annoying. But it should work.