How to configure postfix under Ubuntu 16.04 to securely use Google's smtp relay service.
I've dabbled with encryption several times over the past few decades, never really getting serious about it. It started when, in college, I would see that the faculty in the CS department had these weird signature blocks appended to the their USEnet posts containing something called a public key.
This is like setting a can of lighter fluid and box of blue-tip matches in front of a 10 year-old boy -- irresistible.
What I found in the later years is that using encryption for email is a lot like being one of the early adopters of the telephone. Now that I have one, who am I going to call? My family certainly doesn't use encryption in their email...those that have discovered email anyway.
Co-workers aren't likely to invest the time and effort into encryption simply because we're all too busy with work to be playing spy-games with our de-coder rings.
And, Dorothy, we're not in Academia anymore where, I imagine, it's really in use. Closeted anarchists posting semi-heretical Berkeley-esqe rants against the Proletariat and all that.
And then there's the whole nouveau post-9/11 trend of "Guilty until Proven Innocent" thing happening. I imagine some fedora-capped DHS agent squinting at me in a menacing fashion while I try to reason a plausible excuse for being so brazen as to need encryption for my emails in the first place...
So, at this point, let's assume that, like me, you're willing to whack the hornet's nest with a stick and use encryption for your emails and that you actually have someone on the other end willing to dust-off the de-coder ring and play with you. We'll also assume that you know what PGP, GPG and OpenPGP actually are, and that you know how basic public-key encryption works. (If not, leave comments to this article and I will do a future article explaining same.)
Standard Disclaimer: I am providing this tutorial as a hands-on, learn-with-me type of tutorial. I am not an expert, nor do I pretend to claim anything other than neophyte status when it comes to encryption. I do not advocate, support, or intend for you to use this, or any, technology as a means to intentionally bending, fracturing, or breaking laws in one or more jurisdictions. MY only intent is to share what I've recently learned with you and to have some fun.
OK - that crap out of the way, let's get started. First, as the title implies, this set-up is for Apple Mail under OS X Lion. The release of the OS I'm currently working on is 10.7.4.
Download and install the GPGTools utility (Version 2012.03.18 as of this writing.)
Although this article is for Apple mail, the GPGTools utility includes support for Enigmail in Thunderbird 7. When you launch the installation utility, you'll be presented with a list of packages to install. I installed all packages.
Once the install has been completed, you'll see a little dialog box appear on your desk top telling you the installation was successful, and would you like to read the Quickstart Tutorial? This would be a good thing to do because I am not going to walk you thought the next steps in any great detail. This reference, however, does. With pictures. So... go there and follow the installation step to:
Generate a key
You will generate a public and a private key. Anyone with whom you wish to exchange encrypted email with must also have done the same. They're called public and private keys for a reason. One you share with the public and one you do not. Key, using the nomenclature, are stored on what's called a keyring. There are public and private key-rings. GPGTools refers to key-rings as keychains - these are one and the same things.
Please note that for whichever email account you're going to use to generate a key-pair for, that account must already exist in Apple mail. The email address is case-sensitive so make sure you type it in exactly as it is stored in Apple Mail -- otherwise, your encryption will not work.
Over the years, I have created several key-pairs for various email addresses I have had. What's critically important to remember is this: write down your pass-phrase. Also, click on the Advanced options tab, and set an expiration date (a couple of years is fine and 4-years is the current default - point being: set an expiration date) for your keys. That way if, after a few years, you return to a previous email account address, and you've certainly forgotten your passphrase from lack of use, then you'll still be able to generate a new key pair if the old one has expired. To remove a key pair, most public key rings require you to enter your passphrase. This is known as a conundrum.
Once you've created your passphrase and uploaded your key, and you can see your new key in your keychain, open Apple Mail. Send an email to
the email address you've just created (I know...) and you should see two buttons appear in the lower-right corner of the header bar as shown in the image on the right.
The two buttons, as shown above, allow you to either sign or encrypt your mail message.
Signing your email is flagging the email to the recipient assuring them that it was actually you who sent the mail. In order to sign an email, OpenPGP has to have access to your private key. (You did keep your private key private, right?) Since you're the only one, presumably, with access to your private key, then signing the mail guarantees to the recipient that the mail did come from you.
The recipient does not need to have your public key, nor do you need to have the recipient's public key, to sign an email. Think of this as the "certified mail" from the US Post Office equivalent for email.
If you have a recipient's public key, then you may send them an encrypted email. The recipient will need to have your public key in order to decrypt and read the email -- this is why we store public keys on public key rings.
[codesyntax lang="text" lines="no" capitalize="no"]
-----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) iQEcBAEBAgAGBQJPtnyiAAoJEC4S4zGLhwvBFNMH/1Yoh59etAcYZpAhZ+htpd81 QzZWDxOR2PeXtPkY3GWl4vdW7GABJ9ysl8vpdErsDtXs6LEVZXag5mV6CGTDNXmm pdozUJCgNwbHTgoIUdjinmAXLR+4pYSfALTB1S2qpxzMpykBkR7SMuPm3+0LC77/ dwnsSVx5CNtJd8cPoPjwXJ6zaStJCNK+H17MItS5kpw3MqMU35qZdNCDV6ehhA8j FmTyFoh1TeTmuBrNECWz9z3KniG6SWVl3K21LmS8PQExeHq8qcHGBz5yK2YhoW/w bn4PIyHaUiXKQTNhYBSd1DrCPUWJKDJ+VCKQ0L97aUPeVPQBI14jsFOgc1dwUjs= =xfmB -----END PGP SIGNATURE-----
That's pretty much it -- once you send a signed an encrypted mail, you can rest assured that (hopefully) your emails are safe from casually-prying eyes as they're no longer being sent in clear-text across the ether sphere.
Here's the raw-text (what's sent out over the ether) of an encrypted email message:
[codesyntax lang="text" lines="no" capitalize="no"]
Return-Path: <email@example.com> Received: from [192.168.0.2] (c-50-136-203-107.hsd1.ca.comcast.net. [220.127.116.11]) by mx.google.com with ESMTPS id qu6sm6794406pbc.36.2012.05.18.09.54.57 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 18 May 2012 09:54:58 -0700 (PDT) Content-Type: multipart/encrypted; boundary="Apple-Mail=_4C5344B9-76FE-43EF-8620-073841EBF944"; protocol="application/pgp-encrypted"; Subject: test both Mime-Version: 1.0 (Apple Message framework v1278) X-Pgp-Agent: GPGMail 201 (a30) From: Micheal Shallop <firstname.lastname@example.org> Date: Fri, 18 May 2012 09:54:56 -0700 Content-Transfer-Encoding: 7bit Message-Id: <407C94BA-32A1-4930-B9F6-BBFE7900D213@gmail.com> Content-Description: OpenPGP encrypted message To: Micheal Shallop <email@example.com> X-Mailer: Apple Mail (2.1278) This is an OpenPGP/MIME encrypted message (RFC 2440 and 3156) --Apple-Mail=_4C5344B9-76FE-43EF-8620-073841EBF944 Content-Transfer-Encoding: 7bit Content-Type: application/pgp-encrypted Content-Description: PGP/MIME Versions Identification Version: 1 --Apple-Mail=_4C5344B9-76FE-43EF-8620-073841EBF944 Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename=encrypted.asc Content-Type: application/octet-stream; name=encrypted.asc Content-Description: OpenPGP encrypted message -----BEGIN PGP MESSAGE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) hQEMAy4S4zGLhwvBAQf/YX1vGFhG0CLd7UU79fjHd4/nIHH9DVVsi8oqsmIwBNpl zXvDZf3+uw3B7Shk3bls1fHcUdU8LZprY+HbQVZlh7IiGZ28K67rNIHKUtwuoX2I DpZcLdRPGn1iGi7TNRs/3Fn3fjCCT15uVAbZZRvR1G3XqUc+//3TstCMTaNtg5Rl KZbKnnrOaIt/OAou7BFCLQgGKAAIa3m/gFHEQxxLVaAQ3JISeX4/UZ7YlXAj5SYp juVRKfekmjpoFoM4erf0Jjaw63lSjAZWXJi1m6IY8uSkzQZRUwANMYE577mBiZhw d1kIBJfBlxWjUOK6FYV3bDZFjc2Fn2WM4+tEloOrcNLpASNVPOh332341GjxwVAg USYLkh1Co7yqaQ1c830CD58XxmYsR/x0B8etL1bYQtZDJYITMa649tYCYtrAvHSw GsgwDD67yaICruIJqwPAtz5+fkoF9xnlltz0UTUSsmzrlGkdbkHSnVrvOdgbvJEz 60UM1p7idKEcR5SCkNuLD9hYJaD/C7qRhyxYfjyjPlwtSSb9aSY+TBa0t/lRmPtU q5N/EHRdm3CmTVqE3eT1IOoRsFibYfRJNJnkqgmVZdoHm/QhTOmuyK1SeBbB3P7F Lnw7hS6aB7RMISg8rWiPGap+QVO8lzMjIXhd5BDu1Kxkk5dr7FLOC37aSC7X52VT QcwvYlYPSV5s+ivFk/uKtB8L3k9rHsYHHkP13lli2a9ELy+KTv0SFp0Q8ClaC9Xm RoWXKQxrTV2wxub4/V0UfSSUfct0mHfTFDltpDPAfaEL/ARgvIUI2SD6WXvfbums yG2fS4Rr9NHr9bgkZJqt+anNGQOmly7654ecckD+Nj2PtmXnowBOrub91VvXSfKB TKHZ7xmX9GOnk6qsFZppiXIxDXR9zYeLb5Ks0hCF3XDhXu8DAkS4vbmPm7BIn6fu N1niCzihe187mJ3bKAj5rLSHpbBrMt/XcbaL+eNz7xIEtpWQjk+8qFUaxl5NxIX1 KtCwLhxUeZUCKHIv/cGOJKPANfdhN2SYHasFJvJ1Jts4us4JJg4rBjH50hiYaQ3W OhGSQP7kvcKqMzHBhSXBKPpnwBtJ+tkXy5IpeMHUrREpGt39EOO4oiiyRYSrrm2T GswOJwvv4Z32hreR2eAgfPAXZW3R6MtGA07xN3mqPtV1IO+izegbflVpQEi8Zlq3 KfT/ljoLiDTKdIsrlfIgtgec+G5SH6znO9Kv1IidYg9wtdL6G2bsTP9pCV24bCem srTw3NDKfTK56Yu1ESQpf0WYMTzpGjzDhyHW86F5ej+jJV2rd4kicxvy0HJXOGbI iHPvKVVoA7bMvvfVARoMIlqiQ5gzm41+ =z4VQ -----END PGP MESSAGE----- --Apple-Mail=_4C5344B9-76FE-43EF-8620-073841EBF944--
Reference Pages and Additional Reading:
I've been using Apple machines as my primary and preferred desktop since my cherry iMac in the early 2000's. I then bought a cube, the 12" aluminum iBook, followed by a mac mini, then a white iMac and, today, I work off an iMac 24" I7. I've had a iPod and iPhone since generation 1 and I acquired the first iPad when it was available. While I'm not a slavering fanboi of Apple - I still maintain that they're generally overpriced - I use Apple and their products because, well, simply, they work. They do what you want, when you want it, and they don't interrupt your daily work flow with lots of silly, unnecessary questions or confirmations.
Well, let me revise that. Apple, as a generality, mostly works.
One of the other things I was an early-adopter for was the .mac account, now known as the .me (or dot-me) account. This account, for only $99/year, allows you to keep your personal data in-sync across all Apple hardware (and some PC) products. This is the part that mostly works.
What annoys me the most about the whole .me experience is that you're paying for something which is freely offered elsewhere. That, and the address book part of sync really doesn't work. (If it did, there wouldn't be apps in the AppStore dedicated to cleaning out your address book. Yes, I've bought and tried those. They mostly work in that they manage to eradicate about 90% of the problems in my address book. One release even went so far as to introduce new problems - but that's another story.
And the address book glitches always seem to pop-up at the worst possible time: I need to call the IT-liaison because my production server went down and address-book is now showing me the last 10-years of his phone numbers (apparently, it's really hard to get stuff perma-deleted...) displayed in a bewildering array of information.
Plus, it's really aggravating to have to part with a hundred bucks a year. I mean, a hundred bucks a year isn't a lot, but at one time, it's pretty significant. And, if you don't think so, let me ship you the two teenagers that are living with me right now and you can feed them for a few months, and then you can tell me what you think.
So, despite my inner-paranoia over google's predilection towards harvesting, storing and re-selling my data, I got a daily-use (as opposed to my throw-away) email account and went over to my dot-me account and set-up mail forwarding and vacation mail notices. Which means, that if you've emailed me in the last month or so, you received an auto-response from me stating that me email address has changed - please make a note.
Snicker. Update your address book.
This move was prompted by my new company's heavy usage of google tools. Having tasted the kool-aid, I had no other choice but to submit, slurping down the sugary mixture by the ubergallon.
How-to's on converting your Mac-life over to Google have been done to death and won't be repeated here. The point is that Google mail works (and, if you've not looked at mailplane, and you're using gmail, you should!), the associated tools work - everything works. When you combine all that with a Dropbox account, you've got the complete me-dot-com feature set.
Other than giving-up the .me domain, which I don't view as that much of a status symbol - not compared to .mac - I really don't understand the value-add prop of a dot-me account that you can't get elsewhere....