##############
Email over ssh
##############

The method described here was tested on openSUSE Leap 15.5; on
Ubuntu and other linux distributions this installation of the
software will be different. For the method described here you
need ``root`` access to your linux system.

********************************
Using NetworkManager and dnsmasq
********************************

Sending email using ``smtp.science.ru.nl, port 587`` is possible on campus,
or using ``eduVPN``. If you have ``ssh`` access to ``lilo7.science.ru.nl``
it is possible to use ``dnsmasq`` to redirect ``smtp.science.ru.nl`` to
``127.0.0.1`` (``localhost``) and use ``ssh`` port forwarding to
forward port ``587`` on ``localhost`` to ``lilo7.science.ru.nl``.
As a result, a mail client, e.g. ``thunderbird`` should work with the
same settings as on campus.

Install software
================

Install software and start NetworkManager::

    # (zypper is the OpenSUSE package manager)
    zypper install NetworkManager NetworkManager-dns-dnsmasq
    zypper install dnsmasq
    # Note: do not use systemd to manage dnsmasq
    # NetworkManager will directly call the binary /usr/sbin/dnsmasq

    # Switch to NetworkManager in YaST (the openSUSE setup tool)
    YaST / System / Network Settings / Global Options
    General Network Settings/ Network Setup Method / Network Manager
    # or by hand (systemctl is a systemd command used by many linux distributions)
    systemctl enable NetworkManager
    systemctl start NetworkManager
    # Check
    systemctl status NetworkManager
    cat /etc/resolv.conf
    # will show something like:
    search home
    nameserver 127.0.0.1

Configure NetworkManager (as root)::

    cd /etc/NetworkManager
    mkdir conf.d
    mkdir dnsmasq.d
    # create file conf.d/my.conf with these two lines:

    [main]
    dns=dnsmasq

    # create dnsmasq.d/my.conf with:

    address=/smtp.science.ru.nl/127.0.0.1
    cache-size=1000

    # Restart NetworkManager

    systemctl restart NetworkManager

The ``cache-size`` entry is not essential, but it may speed
up domainname lookup. To test use::

    dig smpt.science.ru.nl +short
    # this should return: 127.0.0.1

Port forwarding can be started by hand with::

    ssh -L 587:localhost:587 lilo7.science.ru.nl
    # or with
    ssh -N -L 587:localhost:587 lilo7.science.ru.nl
    # where the -N flag means "Do not execute a remote command"

When you give the ``ssh`` command you have to enter your passphrase
when prompted. By using an ``ssh-agent`` you will only have
to enter your passphrase once.

The port-forwarding can also be started when booting the system by
adding a ``systemd unit``. It may seem this would require
entering your passphrase at boot time or using ssh keys
without passphrase, but the solution described here requires
neither.

The trick is to let the user that knows the passphrase use
an ``ssh-agent`` with a fixed location of the ssh-agent ``socket``,
e.g., at ``$XDG_RUNTIME_DIR/ssh-agent.sock``::

    # Check whether your linux defines:
    echo $XDG_RUNTIME_DIR
    # I get:
    /run/user/15010
    # the number 15010 is my user id, which you can also find with
    id -u

    # In your .bashrc define a location for a ssh-agent socket:
    export SSH_AUTH_SOCK=$XDG_RUNTIME_DIR/ssh-agent.sock
    # if $XDG_RUNTIME_DIR is not defined you can use another directory,
    # as long as you (the user, not only root) has r/w access to that
    # directory

The user should start the ssh-agent with this socket, this can also
be done in your ``.bashrc`` ::

    export SSH_AUTH_SOCK=$XDG_RUNTIME_DIR/ssh-agent.sock
    ssh-agent -a "$SSH_AUTH_SOCK"

To let the ssh-agent know the passphrase use::

    ssh-add
    # enter the passphrase when prompted
    # check with
    ssh-add -l
    # this should show a hash of your passphrase, like
    256 SHA256:IXZCIzWssOhp1sf3HiT0RUwPZLTKFGnrT2Q1ZDAMua4 user@host.nl (ED25519)

A ``root`` process can now setup port forwarding with ``ssh`` to ``lilo7.science.ru.nl``,
since it can read the ssh-agent socket ``/run/user/15010/ssh-agent.sock``.

The ``systemd`` configuration is found here::

    cd /etc/systemd/system

To add a ``unit`` create a file ``emailtunnel.socket`` (as ``root``) with::

    [Unit]
    Description=Open an SSH connection in order to send an email.

    [Socket]
    ListenStream=127.0.0.1:587
    # Start one SSH connection per TCP connection to 587.
    Accept=true

    [Install]
    WantedBy=sockets.target

Also create, in the same directory, a file ``emailtunnel@.service`` with::

    [Unit]
    Description=An SSH tunnel
    
    [Service]
    # The SSH_AUTH_SOCK should be what was set by the user with the
    # passphrase as explained above
    Environment="SSH_AUTH_SOCK=/run/user/15010/ssh-agent.sock"
    Type=simple
    ExecStart=/usr/bin/ssh gerritg@lilo7.science.ru.nl -- nc smtp.science.ru.nl 587
    StandardInput=socket
    StandardOutput=socket
    StandardError=journal

To load/test/start/start at reboot/ these units use::

    # After changing files in /etc/systemd/system you need:
    systemctl daemon-reload

    # check for messages:
    systemctl status
    journalctl -xau emailtunnel.socket

    # if ok, start it
    sytemctl start emailtunnel.socket

    # to switch the unit off
    sytemctl stop emailtunnel.socket

    # to start this unit at boot time
    systemctl enable emailtunnel.socket

Now, make sure to give the ``ssh-agent`` your passphrase before you
try sending e-mail with ``ssh-add`` (see above). In ``thunderbird``
click on buttons until you finally find the settings for 
``Outgoing Server (SMTP)``. You need to set::

   Description: sending email with science mail account
   Server Name: smtp.science.ru.nl
   Port:        587
   Connection security:   STARTTLS
   Authentication method: Normal password
   Username:              gerritg
   # replace gerritg by your science username

Now when you send an e-mail with thunderbird, ``dnsmasq`` (started
by ``NetworkManager`` will redirect ``smtp.science.ru.nl``
to ``localhost``, and the ``systemd`` socket defined
in ``/etc/systemd/system/emailtunnel.socket`` will connect
port ``587`` to the ssh forwarding command defined in
``/etc/systemd/system/emailtunnel@.service``, which will
get the passphrase from the ``ssh-agent`` from the
socket ``$SSH_AUTH_SOCK`` defined in 
``/etc/systemd/system/emailtunnel@.service``.

If you have ``thunderbird`` working on campus, it should now be
possible to simply copy your entire ``.thunderbird`` directory
to your linux desktop at home or a laptop with::

    rsync -avz lilo7.science.ru.nl:.thunderbird ~/

and have ``thunderbird`` working.

Note that reading e-mail from ``imap.science.ru.nl`` works off-campus in the same way as
on-campus and does not require ``eduVPN`` or ``ssh`` port forwarding.