![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEia7E41IRdHuYxrdlgSmqK6moy-eax4F1tJK7hp2MLuSWljpOjUDhVTMoGI-Xgf-oehaxWPWWXMHgqDZ8vWEKOaOD9EfJ0PULjgip2JSEDj0CAJriub1RhW4g7BSndEEBaBWC0umQ/s200/encryptedletter.png) |
Encrypted Email |
You can view my video on how to Setup an Encrypted GMAIL Relay Server using Sendmail here. There is also a great blog post found here but I had to make some modifications to get it to work properly on my lan for other systems.
More and more we are moving to secure services that were never intended to be secure; E-Mail is one of those challenges. Not every body supports it but we are moving to it, along with our push for https on all websites. This post will deal with a couple of things to setup a Linux Sendmail SMTP Relay server on a Hyper-V Host using a corporate Google Apps account. The reason for the SMTP Relay is because of an ancient piece of software that does not do SMTP Authentication so we have to setup something that can be mostly secured.
To start your going to need a google apps account, I'm using Microsoft Server 2012R2 for the Hyper-V host and Ubuntu 16.04.2 for the virtualized sendmail relay server.
To start we need to make sure we have TLS setup in our Google Apps Account. When you login to your google account It can be found in APPS -> GSUITE -> Settings for Gmail -> Advanced Settings. Scroll down to just above routing.
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3LUHbGlHSXSVNtOTlEoH9YG16GVflx3GTcazhtqehEBhilMjvHIhZdha3TtTfzZP2YJAiMOEhC4wJsOXr5QXIClJr5yyVai2p7GuoaKxkQnnsViRiHPe7ymA43UMykW8lBg7AuQ/s640/02.png) |
Edit Secure Transport Compliance |
Now for this setup I've applied TLS to all outgoing traffic for one email address no_reply; that is the email I'll be using for the relay server.
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhe-kyager0bZxyPAfBigCrcYkhqmP6SUC1J5JKxfWV6okL7qZuFaDpjyAGzr6Cb9SZ-5wcJA3Edn77w7M42sIqFCJct3QuEVXkJZcxF3YaYr6Og4nfvG_Lmb0qDlZD4kY5fdrPIQ/s640/03.PNG) |
TLS Settings |
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMC2tJC27PCQlZZ-I4JtOLWcQnLHle0Qv6sdyjE1WNn7kDiFpr2Szdgf6vm0KtiC6WDjuSTshbc5xJN__8l2pFpf7VleGlrL0G-TR4c_nEnm5RGjrWpeWMXhN6LxCD5EoOjRtPaA/s640/TLS_Settings.PNG) |
TLS Settings |
Once that is all setup we can start working on our virtualized Ubuntu server. This is a 16.04.2 LTS running on Hyper-V. Of course verify that you have all your Hyper-V guest tools installed and enabled. Then we are going to want to install sendmail, mailutils, and sendmail-bin
sudo apt-get install sendmail mailutils sendmail-bin
Once installed we will be working out of the /etc/mail directory.
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjFV-bIsqbSGHwdBRkuhCQIx2vcUPlzfRe-gHRLmWXYfW7GrI2a7Rg3KeKuh4B89mmsI0bBQOT1CvotalS8oY4J8m0tSsPHPn3hs0bMlh4BAbLYYouLwtRgKQHalz0PlrmVdA_DXw/s640/maildir.png) |
/etc/mail directory |
First make a directory call authinfo this is where we are going to create and save our file for our gmail authentication. Inside the folder we are going to create a file called gmail-auth
inside gmail-auth we are going to have the following.
AuthInfo: "U:root" "I:youremail@domain.com" "P:PASSWORD"
so for the purposes of this example.
AuthInfo: "U:root" "I:no-reply@domain.ca" "P:ThisISmyPASSWORD"
Now we make our hash.
my location is /etc/mail/authinfo
sudo makemap hash gmail-auth < gmail-auth
/*------This is not necessary any more unless your making a------*/
secure sendmail relay for your own domain.
Now we need to make a relay-domains file edit the sendmail.mc and access files so we can do a cd ../ or /etc/mail
We will start with the relay-domains file and are going to put the domains you want to relay, just like the sample below with each domain on a separate line. more information can be found at http://www.sendmail.org/~ca/email/doc8.12/cf/m4/anti_spam.html
domain1.com
domain2.com
/*------Continue After This Point------*/
Save the file and now edit sendmail.mc
my location is /etc/mail - editing sendmail.mc
You will want to go to lines 57 and 59 in the sendmail.mc file and comment them out.
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKCtKvq7mTxGBR5uFuV5bOA1cI86_mjd2iq3OdjvHwlOl2MFO9giIHLsxYuqae1vQfI3iQnPrgV9hsV-8OcGHb_fRs9VTAi5d0Wstx25wewDNL3grllz1RNL8039vZIFAzeSa7ZQ/s640/comment+out.PNG) |
Before Commenting |
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4AsnvdegiW-KPQ5DM8IeV7dKwwHC5CfQr1Ld9f-UCSAm1OM9fYESi45BTEdPhwWW6AtOuINEVzOK2Gjdw2nQWAlTLUozNGFOW63cRbgJ7xgbtiL8C6TzW03OHimnbtXmvFB-aIw/s640/comment+out+2.PNG) |
After Commenting |
Now we want to enable access to our access control database to blacklist networks we don't want to have access to our Sendmail relay (If there is any firewall rules allowing it which there shouldn't be)
FEATURE(`access_db'), `hash -T /etc/mail/access')dnl
We're going to come back to this guy later and blacklist the networks we don't want to have access to the relay. You could also blacklist everything but the host you want to allow to forward. This must be set if we are going to use relay_hosts_only.
then We are going to specify some special resolver options
https://docstore.mik.ua/orelly/other/Sendmail_3rd/1565928393_ch24-46068.html
define(`confBIND_OPTS', `WorkAroundBrokenAAAA -DNSRCH -DEFNAMES')dnl
We are going to open up our sendmail server to allow relaying of mail from other machines on our network.
UPDATE
After coming back to this after the weekend to put into production, I discovered that having the relay_hosts_only option only allows for internal emails, which it didn't when I was putting this together but it doesn't work to domains outside the organization anymore which doesn't work for what I need it to do so I had to enable FEATURE(`promiscuous_relay')dnl
I did not want to do this but I need to be able to send emails out to other addresses then my own domain. However blacklisting in the access file does still blockout networks you don't want to access the
/*------This is not necessary any more unless your making a------*/
secure sendmail relay for your own domain.
***/---I've made the sendmail server more secure using relay_hosts_only---/***
define(`confCR_FILE', `-o /etc/mail/relay-domains')dnl << - $=R
FEATURE(`relay_hosts_only')dnl
More information on relay_hosts_only
FEATURE(relay_hosts_only) Normally domains are listed in /etc/mail/relay-domains; any hosts in those domains match. With this feature, each host in a domain must be listed.
FEATURE(access_db) This enables the hash database /etc/mail/access to enable or disable access from individual domains (or hosts, if FEATURE(relay_hosts_only) is set).
for more options and details go to http://www.sendmail.org/~ca/email/doc8.12/cf/m4/anti_spam.html
define(`confCR_FILE', `-o /etc/mail/relay-domains')dnl << -$=R
FEATURE(`relay_hosts_only')dnl
/*------Continue After This Point------*/
/***----------------------------- Put the following in your sendmail.mc -----------------------------***/
FEATURE(`promiscuous_relay')dnl
define(`SMART_HOST',`[smtp.gmail.com]')dnl
define(`RELAY_MAILER_ARGS', `TCP $h 587')dnl
define(`ESMTP_MAILER_ARGS', `TCP $h 587')dnl
define(`confAUTH_OPTIONS', `A p')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
FEATURE(`authinfo',`hash -o /etc/mail/authinfo/gmail-auth.db')dnl
Your sendmail.mc file should look something like this
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBb1k9dFm3pa72mTV42ZSJzK4j2EXPTv0M_LkJ_gXPOU69B6Tk1sKiyZuyhznB1QJGmyD50PAjUnB-g68Jlsv3XeUpp3w_MqAK5IWHjRHSs75LfO08f5K3VKk6th0iG1YrVui7Kw/s640/settings3.PNG) |
SENDMAIL.MC |
Now save your file and edit your access file. I changed the local connection access to reject so the server itself can't send email.
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWYK2huf_ZyOt8NRievw6JH-p9w-CDSB2bxW83zbOM7vNiQR9BPNmMwR_6JJzmQFgOoFLoBvJbD6wRfUPPeDu5_DlMwgWFqOqpNB6K1vU4uEYTDnGuNNb9m51dCiqRyGCSxFqTbQ/s640/reject+local+host.PNG) |
Reject Localhost |
At the bottom of the access file the networks I want to blacklist.
###Custom###
Connect:192.168.1 REJECT
Connect:172.16.4 REJECT
Connect:172.31.248 REJECT
Domain.com RELAY
Save your access file
Run sudo sendmailconfig. This will recompile sendmail, access and restart the sendmail service. If you get no errors then test your configuration computer on your lan that has a sendmail program like Cobian Backup. When it successfully sends an email you should see something like the result below.
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirPKEcTEJPkRIOW1134kgxDZ8M_C326v78_pI31-R_T57LijQDYkPVn1IFWdsfJVm13bCMQqFg7AzcsJEJJ3IdTnIB-aGE_kgbkBYUMHWnT4gwxnmRS9_LS_kXci7qHIA7ldk3Dw/s640/endresult.png) |
Encrypted Email Via Sendmail |