contact :: legal :: webstats  also on this site: - select - home tech writings green business studies conspiracy popular pages welcome  also in this section:  tech index  most popular pages  search: Like this site? Your donation is welcome!

The root user can receive a lot of email, and if left unchecked, this can accumulate into a very large file, which could potentially fill /var. However, emptying this mailbox can be a pain, especially if the machine is at a remote location, behind a firewall.

This page details a method to securely obtain root's email, via the internet, without using POP3S and without reconfiguring the router. The process below tunnels the POP3 connection via SSH, this keeps things nice and simple, does not expose the POP3 server to the internet, and does not open any extra ports on the firewall. The process below also redirects root's email to another user, this means that root's password does not need to be stored in the POP3 client used to check the mail.

redirecting root's mail

1. ensure your SSH server is installed and working
2. ensure your POP server is installed and working
3. allocate a username and password for the user to receive root's mail, then note these down in a secure location
4. login to the server as root
5. create a new user (eg. rootmail) with no special group memberships: type adduser and follow the prompts - set the shell to nologin, use the password allocated earlier
6. cd /etc/mail
7. vi aliases
8. uncomment root line and redirect to our new user - eg. the line should read root:rootmail (spacing is unimportant)
9. save and exit the editor
10. cd /etc/mail/
11. make
12. copy all of root's existing mail to our new user's mailbox:

    cat /var/mail/root >> /var/mail/rootmail
    

13. empty root's mailbox:

    cat /dev/null > /var/mail/root
    

14. test the redirection:

    echo "test mail" | mailx -s "test mail" root
    

    The mail should be written to /var/mail/rootmail, while /var/mail/root should remain empty.

Now, root's mail is available for download via POP3, using the unprivileged account "rootmail".

securing the POP3 connection

The above account could be checked as-is, across the internet, if port-forwarding was set up, however we want to use SSH, this saves us from having to configure SSL support in our POP3 server and client, and having to set up port-forwarding on the router.

Create the SSH tunnel with PuTTY as follows:

1. open PuTTY
2. select the correct session, then click the Load button
3. go to Connections.. SSH.. Tunnels
4. enter a local port number (eg. 5110) into the source port box
5. enter localhost:110 into the destination box
6. click the Add button
7. click Session.. Save
8. close PuTTY

Open your POP3 client software (eg. Thunderbird) and create a new POP3 account with the following settings:

• username: rootmail (set this to the account that receives root's mail)
• password: (defined when you created the rootmail account)
• server: localhost
• port: 5110 (or whatever you used for the source port when creating the tunnel in PuTTY)

This done, the rootmail account can be checked with POP3 whenever the SSH tunnel is open.

related articles:  my FreeBSD diary  FreeBSD and ATA disks  adding a disk  upgrading a disk  FreeBSD backups  backing up to a remote volume  Samba as a file server (low security)  Samba as a file server (high security)  Samba as a Primary Domain Controller  Samba as a member server  Samba as a print server (with CUPS)  troubleshooting Samba  troubleshooting printing with CUPS  configuring sendmail  installing phpMyAdmin  dealing with mail for root  working with cron  installing and using GPG  automated PHP scripting  special-purpose users  upgrading to key-based authentication  distributed data warehousing  doing a minor version upgrade  upgrading from 6.1 to 6.4  upgrading 6.2 and below  installing and using Webmin  installing and using denyhosts  filesystem access controls  unix basics