Recipe 8.17 Receiving Mail Without a Visible Server

8.17.1 Problem

You want to receive Internet email without running a publicly accessible mail server or daemon.

8.17.2 Solution

Don't run a mail daemon. Queue your mail on another ISP and use fetchmail to download it. Authenticate to the ISP via SSH, and transfer the email messages over an SSH tunnel. Then have fetchmail invoke your local mail delivery agent directly to deliver the mail.

~/.fetchmailrc:
poll imap.example.com with proto IMAP:
preauth ssh
plugin "ssh %h /usr/sbin/imapd";
user 'shawn' there is smith here;
mda "/usr/sbin/sendmail -oem -f %F %T"
fetchall;
no keep;

~/.bash_profile:
if [ -z "$SSH_AGENT_PID" ]
then
        eval `/usr/bin/ssh-agent` > /dev/null 2> /dev/null
fi

~/.bashrc:
(/usr/bin/ssh-add -l | /bin/grep -q 'no identities') \
        && /usr/bin/ssh-add \
        && /usr/bin/fetchmail -d 600

8.17.3 Discussion

fetchmail is the Swiss army knife of mail delivery. Using a powerful configuration mechanism (~/.fetchmailrc), fetchmail can poll remote IMAP and POP servers, retrieve messages, and forward them through sendmail and other mail delivery systems.

For security reasons, you might not want a sendmail daemon visible to the outside world, and yet you want mail delivered locally. For example, the machine where you read mail could be behind a firewall.

This recipe is run by user smith on the local machine. When he logs in, the given commands in his .bash_profile and .bashrc make sure an SSH agent [Recipe 6.9] is running and is loaded with the necessary keys. Also fetchmail is launched, polling a remote IMAP server, imap.example.com, every 10 minutes (600 seconds). fetchmail authenticates via SSH as user shawn@imap.example.com and downloads all messages (fetchall) in shawn's mailbox. These messages are delivered to smith's local mailbox by invoking sendmail directly (mda). Our recipe also deletes the messages from the IMAP server (no keep) but this is optional: you might skip this until you're sure things are working correctly.

While smith is not logged in, fetchmail doesn't run. Mail will arrive normally on imap.example.com, awaiting retrieval.

If you prefer to run a mail daemon (sendmail -bd) on the machine receiving your email messages, simply delete the mda line.

fetchmail is tremendously useful and has tons of options. The manpage is well worth reading in full.