indoFreeBSD - Komunitas FreeBSD Indonesia

1. Persiapan aplikasi yg dipake:

Install OpenSSL

# cd /usr/ports/security/openssl
# make install USE_NONDEFAULT_X11BASE=yes
# make clean USE_NONDEFAULT_X11BASE=yes

Install fetchmail pastikan support SSL.

# cd /usr/ports/mail/fetchmail
# make install USE_NONDEFAULT_X11BASE=yes
# make clean USE_NONDEFAULT_X11BASE=yes

Install mutt

# cd /usr/ports/mail/fetchmail
# make install USE_NONDEFAULT_X11BASE=yes
# make clean USE_NONDEFAULT_X11BASE=yes

Install maildrop.

# cd /usr/ports/mail/maildrop
# make install USE_NONDEFAULT_X11BASE=yes
# make clean USE_NONDEFAULT_X11BASE=yes

Install ssmtp.

# cd /usr/ports/mail/ssmtp
# make USE_NONDEFAULT_X11BASE=yes

Modifikasi biar sedikit tampil lebih gaya:

# cd /usr/ports/mail/ssmtp/work/ssmtp-2.61
# vim ssmtp.c
...
smtp_write(sock,
"Received: by %s (sSMTP by Internet and Game PC Kumprang); %s", hostname, arpadate);
...
# make install USE_NONDEFAULT_X11BASE=yes FORCE_PKG_REGISTER=yes
# make clean USE_NONDEFAULT_X11BASE=yes

2. Pengecekan dan konfigurasi:

# openssl version
OpenSSL 0.9.7d 17 Mar 2004
# fetchmail -V
   ...
   This is fetchmail release 6.3.8+RPA+SDPS+SSL+OPIE+NLS.
   ...
   # cat /usr/local/etc/ssmtp/ssmtp.conf
   root=postmaster
   mailhub=smtp.gmail.com:465
   rewriteDomain=indofreebsd.or.id
   hostname=mx1.kumprang.com
   FromLineOverride=YES
   UseTLS=YES

3. Pembuatan hash sertifikat untuk GMAIL:

Pertama-tama kita check gmail sertifikat terlebih dahulu:

$ openssl s_client -connect pop.gmail.com:995 -showcerts
     CONNECTED(00000003)
     depth=0 /C=US/ST=California/L=Mountain View/O=Google Inc./CN=pop.gmail.com
     verify error:num=20:unable to get local issuer certificate verify return:1
     depth=0 /C=US/ST=California/L=Mountain View/O=Google Inc./CN=pop.gmail.com
     verify error:num=27:certificate not trusted verify return:1 depth=0
     /C=US/ST=California/L=Mountain View/O=Google Inc./CN=pop.gmail.com verify
     error:num=21:unable to verify the first certificate verify return:1
     ---
     Certificate chain
     0 s:/C=US/ST=California/L=Mountain View/O=Google Inc./CN=pop.gmail.com
     i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority

     -----BEGIN CERTIFICATE-----
     MIIC3TCCAkagAwIBAgIDBZIAMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT
     MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0
     aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDUxMTE1MjEyMjQ0WhcNMDcxMTE2MjEyMjQ0
     WjBoMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMN
     TW91bnRhaW4gVmlldzEUMBIGA1UEChMLR29vZ2xlIEluYy4xFjAUBgNVBAMTDXBv
     cC5nbWFpbC5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMP8LCYiLGJ/
     RihwcOi1V/zHVTw0Gfu+mI141Vjuuj2DtQoav8emwlXbu8gZoKP9GeMWpX1Vo9qN
     4gkslIToHmDnIwGjcaEAfpdhSR9g54Kf5Y7BEXVyco6mTIlpe9vsbV0dmB1FvLP2
     1N09dkUJfi7V0fjb8mcn3QYu6+6QNoxPAgMBAAGjga4wgaswDgYDVR0PAQH/BAQD
     AgTwMB0GA1UdDgQWBBTdASsopgao1m8hcEg0cDZhucltljA6BgNVHR8EMzAxMC+g
     LaArhilodHRwOi8vY3JsLmdlb3RydXN0LmNvbS9jcmxzL3NlY3VyZWNhLmNybDAf
     BgNVHSMEGDAWgBRI5mj5K9KylddH2CMgEE8zmJCf1DAdBgNVHSUEFjAUBggrBgEF
     BQcDAQYIKwYBBQUHAwIwDQYJKoZIhvcNAQEFBQADgYEAln3/pVqYnUXA1TVGzOqX
     LFhohGxpuNkr1UJnQmYxmZeB07uPBYRX8c0JXEKs29TmAHRsLhmp8kF36F11Dxgi
     Xm/Y8I9zgWHoMj7SL3Ve/u8K8K7XcUyUuaWmldLQAREafpFy+f+KYHGuAVh8hjy6
     XyPlMCqj+PNp8QXjgOcgO68=
     -----END CERTIFICATE-----

     ---
     Server certificate subject=/C=US/ST=California/L=Mountain View/O=Google
     Inc./CN=pop.gmail.com
     issuer=/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
     ---
     No client certificate CA names sent
     ---

     SSL handshake has read 891 bytes and written 332 bytes
     ---
        New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA
        Server public key is 1024 bit SSL-Session:
            Protocol : TLSv1
            Cipher    : DES-CBC3-SHA
            Session-ID: 5F4FE4CBB7570F4573E0FD5DA79A5EE266C378B4DA3A31B6A059E23A93B50DB5
        Session-ID-ctx:
        Master-Key: E95C6302CEA173BBABDC0B37B5D513FEB4BB0607583DF57AF516B953BA185ECA8331ED00F80BE743DBB859EEC69FC992
        Key-Arg   : None
        Start Time: 1183280803
        Timeout   : 300 (sec)
        Verify return code: 21 (unable to verify the first certificate)
     ---
     +OK Gpop ready for requests from 125.163.77.180 a8pf4339996poa read:errno=0

Atau biar lebih gampang download saja:

$ fetch http://optusnet.dl.sourceforge.net/sourceforge/souptonuts/googlepop.pem
$ fetch http://optusnet.dl.sourceforge.net/sourceforge/souptonuts/equifax.pem

Biar default $PATH bisa digunakan untuk semua user dalam 1 box lebih baik ada simpan di /usr/src/crypto/openssl/certs/.

$ su -
# cd /usr/src/crypto/openssl/certs/
# mv ~budsz/*.pem /usr/src/crypto/openssl/certs/
# chown root:wheel googlepop.pem ; chmod 644 googlepop.pem
# chown root:wheel equifax.pem ; chmod 644 equifax.pem

Rehash atau creating symlinks:

# cd /usr/src/crypto/openssl/certs/
# c_rehash .
# ls -l | grep googlepop.pem
     lrwxr-xr-x    1 root     wheel          13 Jul 1 04:08 7f549ca4.0 -> googlepop.pem
     -rw-r--r--    1 root     wheel        1054 Jul 1 03:35 googlepop.pem
# ls -l | grep equifax.pem
     lrwxr-xr-x    1 root     wheel          11 Jul 1 04:08 594f1775.0 -> equifax.pem
     -rw-r--r--    1 root     wheel        1143 Jul 1 03:35 equifax.pem

Kita check ulang sertifikat yg sudah kita bikin:

$ openssl s_client -connect pop.gmail.com:995 -CApath /usr/src/crypto/openssl/certs
     CONNECTED(00000003)
     depth=1 /C=US/O=Equifax/OU=Equifax Secure Certificate Authority verify return:1
     depth=0 /C=US/ST=California/L=Mountain View/O=Google Inc./CN=pop.gmail.com
     verify return:1
     ---
     Certificate chain 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc./CN=pop.gmail.com
     i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
     ---
     Server certificate

     -----BEGIN CERTIFICATE-----
     MIIC3TCCAkagAwIBAgIDBZIAMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT
     MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0
     aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDUxMTE1MjEyMjQ0WhcNMDcxMTE2MjEyMjQ0
     WjBoMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMN
     TW91bnRhaW4gVmlldzEUMBIGA1UEChMLR29vZ2xlIEluYy4xFjAUBgNVBAMTDXBv
     cC5nbWFpbC5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMP8LCYiLGJ/
     RihwcOi1V/zHVTw0Gfu+mI141Vjuuj2DtQoav8emwlXbu8gZoKP9GeMWpX1Vo9qN
     4gkslIToHmDnIwGjcaEAfpdhSR9g54Kf5Y7BEXVyco6mTIlpe9vsbV0dmB1FvLP2
     1N09dkUJfi7V0fjb8mcn3QYu6+6QNoxPAgMBAAGjga4wgaswDgYDVR0PAQH/BAQD
     AgTwMB0GA1UdDgQWBBTdASsopgao1m8hcEg0cDZhucltljA6BgNVHR8EMzAxMC+g
     LaArhilodHRwOi8vY3JsLmdlb3RydXN0LmNvbS9jcmxzL3NlY3VyZWNhLmNybDAf
     BgNVHSMEGDAWgBRI5mj5K9KylddH2CMgEE8zmJCf1DAdBgNVHSUEFjAUBggrBgEF
     BQcDAQYIKwYBBQUHAwIwDQYJKoZIhvcNAQEFBQADgYEAln3/pVqYnUXA1TVGzOqX
     LFhohGxpuNkr1UJnQmYxmZeB07uPBYRX8c0JXEKs29TmAHRsLhmp8kF36F11Dxgi
     Xm/Y8I9zgWHoMj7SL3Ve/u8K8K7XcUyUuaWmldLQAREafpFy+f+KYHGuAVh8hjy6
     XyPlMCqj+PNp8QXjgOcgO68=
     -----END CERTIFICATE-----

     subject=/C=US/ST=California/L=Mountain View/O=Google Inc./CN=pop.gmail.com
     issuer=/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
     ---
     No client certificate CA names sent
     ---
     SSL handshake has read 891 bytes and written 332 bytes
     ---
        New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA
        Server public key is 1024 bit
        SSL-Session:
             Protocol : TLSv1
             Cipher    : DES-CBC3-SHA
             Session-ID: EC899FC10993E2B51F535333AD63EF068D865D94A6C7909F3B891F70D772527E
        Session-ID-ctx:
        Master-Key: F0E08E5C77CA67527D324F9BBD08C439F1D0CDA2A2B98A2E3EF2950D198E7CA6475E9197AACFB8655155D9D0F29451F4
        Key-Arg   : None
        Start Time: 1183282436
        Timeout   : 300 (sec)
        Verify return code: 0 (ok)
    ---
    +OK Gpop ready for requests from 125.163.77.180 m26pf4352051pof read:errno=0

4. File-file yg diperlukan $HOME, diataranya ~/.fetchmailrc:

$ cat .fetchmailrc
   poll pop.gmail.com
   proto POP3
   user This e-mail address is being protected from spambots. You need JavaScript enabled to view it
   password xxxxxx
   options nokeep ssl sslcertpath /usr/src/crypto/openssl/certs/ smtp smtp.gmail.com
   mda "formail -bcYzq- | /usr/local/bin/maildrop"

$ grep "set sendmail" .muttrc
set sendmail="/home/budsz/gmail-smtp.sh"

$ cat gmail-smtp.sh
   #!/bin/sh
   /usr/local/sbin/ssmtp -au " This e-mail address is being protected from spambots. You need JavaScript enabled to view it " -ap "xxxxxx" $@
   $ chmod 700 gmail-smtp.sh
   $ cat .mailfilter
   PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
   SENDMAIL="/usr/local/sbin/ssmtp"
   SHELL="/bin/sh"
   VERBOSE="0"
   LOGNAME="$HOME/Mail/Log"
   LOG="$HOME/Mail/log"
   DEFAULT="$HOME/Mail/Inbox"
   MAILDIR="$HOME/Mail"

   `reformail -D 8000 duplicate.cache`
   if ( $RETURNCODE ==0 )
   exit

Silakan isikan filter mail selengkapnya, kita test nge-pop skg:

$ fetchmail -va -f ~/.fetchmailrc
   fetchmail: 6.3.8 querying pop.gmail.com (protocol POP3) at Sun Jul 1 19:44:58 2007: poll started
   Trying to connect to 72.14.253.109/995...connected.
   fetchmail: Issuer Organization: Equifax
   fetchmail: Unknown Issuer CommonName
   fetchmail: Server CommonName: pop.gmail.com
   fetchmail: pop.gmail.com key fingerprint: 59:51:61:89:CD:DD:B2:35:94:BB:44:97:A0:39:D5:B4
   fetchmail: POP3< +OK Gpop ready for requests from 125.163.77.180 y11pf4448332pod
   fetchmail: POP3> CAPA
   fetchmail: POP3< +OK Capability list follows
   fetchmail: POP3< USER
   fetchmail: POP3< RESP-CODES
   fetchmail: POP3< EXPIRE 0
   fetchmail: POP3< LOGIN-DELAY 300
   fetchmail: POP3< X-GOOGLE-VERHOEVEN
   fetchmail: POP3< UIDL
   fetchmail: POP3< .
   fetchmail: POP3> USER This e-mail address is being protected from spambots. You need JavaScript enabled to view it
   fetchmail: POP3< +OK send PASS
   fetchmail: POP3> PASS *
   fetchmail: POP3< +OK Welcome.
   fetchmail: POP3> STAT
   fetchmail: POP3< +OK 1 1835
   1 message for This e-mail address is being protected from spambots. You need JavaScript enabled to view it at pop.gmail.com (1835 octets).
   fetchmail: POP3> LIST 1
   fetchmail: POP3< +OK 1 1835
   fetchmail: POP3> RETR 1
   fetchmail: POP3< +OK message follows
   reading message This e-mail address is being protected from spambots. You need JavaScript enabled to view it @gmail-pop.l.google.com:1 of 1 (1835 octets)
   #*********** flushed
   fetchmail: POP3> DELE 1
   fetchmail: POP3< +OK marked for deletion
   fetchmail: POP3> QUIT
   fetchmail: POP3< +OK Farewell.
   fetchmail: 6.3.8 querying pop.gmail.com (protocol POP3) at Sun Jul 1 19:45:02 2007: poll completed
   fetchmail: normal termination, status 0