0

One would think this is a dead simple thing, but apparently it isn't—or I just really suck at it.

Context: I have a little home server hosting things like task-managers (TaskWarrior), my website, my IRC bouncer, etc. I try to keep this server as secure as possible. Also, I would like to keep it well-maintained.

I thought it would be nice to receive some periodic/event-triggered emails from this server to detect possible security breaches, failed services and other problems. The actual implementation is irrelevant, I'd either just send myself the outputs of periodic maintenance scripts or perhaps grep some keywords out of logfiles.

The problem is that I am stuck at simply sending an email to my address. What I tried:

  1. I need an SMTP server to send the email, so I should just use my email service provider's, I guess (mailbox.org). This is how it turned out:
$ openssl s_client -connect smtp.mailbox.org:465
[...]
---
220 smtp2.mailbox.org ESMTP Postfix
HELO myhostname
250 smtp2.mailbox.org
MAIL FROM: me@myhostname
250 2.1.0 Ok
RCPT TO: me@mailbox.org
554 5.7.1 <my-ip:30920>: Client host rejected: Access denied

I am not sure if this has to do with having to authenticate on the server. I tried with smtp.gmail.com as well, but I got an 530-5.5.1 Authentication Required reply to my MAIL FROM there. However, I would rather like to avoid Google anyway.

  1. Supposing the failure is due to having to authenticate, I face another problem: sure, I could just tell my MTA (let's say dma or msmtp) my password for my mailbox.org account, it doesn't sound like a good idea. I am not experienced enough in setting up security to be certain my server won't be hacked easily. I know that once root access is gained I am done for, but I could still mitigate the damage by I don't know, not having my plaintext passwords scattered around the server? Normally, I keep them GPG-encrypted using password-store.

  2. Perhaps I should run my own SMTP server? I can't use my domain for that though, since I have set up mailbox.org with emails of my own domains, so my MX DNS records point to their servers. I don't really want to buy another domain just for this...


Summary & TL;DR

Is there some way to simply send emails to my own address provided by mailbox.org from my server without

  • running and maintaining a complex SMTP server on my server
  • having to expose sensitive information such as my passphrase on the server to log into the provider's SMTP server?
1
+50

If you only want to send email to your mailbox.org account; you can set up your mail client to send mail directly into mailbox.org's MX servers. This will only allow you to send email to @mailbox.org accounts, not to the rest of the internet. This is because SMTP servers with the "MX" role, will not allow mail other than for their own destination (or at least, they shouldn't :) ).

Use mx1.mailbox.org as the SMTP server, on port 25, unauthenticated.

For example:

mtak@dc4:~$ telnet mx1.mailbox.org 25
Trying 2001:67c:2050:104:0:1:25:1...
Connected to mx1.mailbox.org.
Escape character is '^]'.
220 mx1.mailbox.org ESMTP Postfix
HELO dc4.mtak.nl
250 mx1.mailbox.org
MAIL FROM: test@mtak.nl
250 2.1.0 Ok
RCPT TO: postmaster@mailbox.org
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
Subject: Test email
This is a test email
.
250 2.0.0 Ok: queued as EBEE94F466
quit
221 2.0.0 Bye
Connection closed by foreign host.
|improve this answer|||||
  • Thanks for your answer. I think the problem here is that I misunderstood how ISP's commonly block traffic on port 25: I thought incoming traffic is blocked for some reason, but I found that they block outgoing traffic in order to prevent spam from being sent from their network. I suppose this is the reason I am unable to connect to mailbox.org's SMTP servers on port 25. – bp99 Jul 19 '19 at 13:00
  • That minor detail would've been useful to mention in your question ;) In that case, I have no solution for you. I'm gonna leave this answer here anyways, because technically it does answer your (current) question and it might help someone in the future. – mtak Jul 19 '19 at 13:36
  • Well, I didn't know, I only realized this now. I will look if I can request my ISP to allow me through the filtering of port 25. Your answer indeed answers my question however, thank you. – bp99 Jul 19 '19 at 13:40
1

Answering the part about sending emails with gmail not working since i have encountered the same problem:

To send emails using google's smtp you have to enable a setting called less secure apps otherwise it won't work, found in: google account, security, less secure apps. After that you can use your favorite mail command, (mail, sendmail, sendemail, ssmtp ..), just remember to turn on tls option for that command.

Security wise, create an address specifically for that purpose and you are good.

If that is not good enough, you can enable two factor auth for your single purpose gmail account then generate an app password (also in account, security) and store that on your server and use it in place of the password (you can't use your password to send emails with 2FA enabled, you have to use an app password).

Example with sendemail command:

cat body.txt | sendemail -f "youremail@gmail.com" -u "subject" -t "receiver@domain.com" -s "smtp.gmail.com:587" -o tls=yes -xu "youremail@gmail.com" -xp "Account Password or App password if 2FA is enabled"
|improve this answer|||||
  • While this answer gives useful information, it is not closely relevant to my question: I was trying to use Google's SMTP server unauthenticated (ie without a Google account), which is not possible. Nevertheless, thank you for providing information about app passwords and the less secure app setting for people finding this in the future. – bp99 Jul 24 '19 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.