Mengambil gmail menggunakan fetchmail - Revision history

Onnowpurbo at 22:44, 31 March 2011

2011-03-31T22:44:29Z

Onnowpurbo at 00:44, 11 May 2010

2010-05-11T00:44:37Z

Onnowpurbo at 23:48, 20 April 2010

2010-04-20T23:48:52Z

Onnowpurbo at 04:00, 16 January 2010

2010-01-16T04:00:46Z

Onnowpurbo at 03:46, 16 January 2010

2010-01-16T03:46:21Z

Onnowpurbo at 03:41, 16 January 2010

2010-01-16T03:41:24Z

Show changes

Onnowpurbo at 08:05, 12 January 2010

2010-01-12T08:05:03Z

Onnowpurbo: /* Referensi */

2010-01-12T07:51:10Z

Referensi

Onnowpurbo: New page: Configuring your incoming email client for Gmail: fetchmail 1. Enable POP in your Gmail account. 2. Find out where X.509/“privacy-enhanced-mail (PEM)” certificates...

2010-01-12T07:50:36Z

New page: Configuring your incoming email client for Gmail: fetchmail 1. Enable POP in your Gmail account. 2. Find out where X.509/“privacy-enhanced-mail (PEM)” certificates...

New page

Configuring your incoming email client for Gmail: fetchmail

1.

Enable POP in your Gmail account.
2.

Find out where X.509/“privacy-enhanced-mail (PEM)” certificates live on your system, e.g., in the /usr/share/ssl/certs/ directory. The “locate .pem” command may help you figure this out, or you can just create a new world-readable directory exclusively for this.
3.

The Gmail POP3-over-SSL (pop3s) server presents a server certificate at every secure-socket-layer (SSL) connection establishment; we will want to be able to verify its authenticity.

(A new server certificate was rolled out by Gmail on 2005-12-13 when the old one expired on that same day with a few minutes of POP service unavailability.)

That server certificate is itself signed by a certificate authority (CA), Equifax Secure (now GeoTrust), using a self-signed root certificate having the “Equifax Secure Certificate Authority” organizational unit name (OU) and no common name (CN). You need to download, install in its own file, and index this root certificate.

sh# cd /usr/share/ssl/certs
sh# wget -O Equifax_Secure_Certificate_Authority.pem \
https://www.geotrust.com/resources/root_certificates/certificates/Equifax_Secure_Certificate_Authority.cer
sh# chmod 644 Equifax_Secure_Certificate_Authority.pem
sh# openssl x509 -in Equifax_Secure_Certificate_Authority.pem \
-fingerprint -subject -issuer -serial -hash -noout
MD5 Fingerprint=67:CB:9D:C0:13:24:8A:82:9B:B2:17:1E:D1:1B:EC:D4
subject= /C=US/O=Equifax/OU=Equifax Secure Certificate Authority
issuer= /C=US/O=Equifax/OU=Equifax Secure Certificate Authority
serial=35DEF4CF
594f1775
sh# c_rehash .
sh# file 594f1775.*
594f1775.0: symbolic link to `Equifax_Secure_Certificate_Authority.pem'

The c_rehash command is a Perl script that comes with the OpenSSL toolkit; it creates symbolic links to certificate files (with a “.pem” extension) using symlink names based on a hash of each certificate's whole subject name. Fetchmail uses the OpenSSL libraries and will only try to open the installed file by looking it up under the 594f1775.0 (or 594f1775.1 and so on) file name in the end.

The server certificate itself does not need to be stored anywhere.
4.

The fetchmail client does not need to present a client certificate. Instead, client authentication is performed using the USER and PASS post-office-protocol version 3 (POP3) commands within the SSL connection, once it has been properly established.
5.

Edit the appropriate .fetchmailrc file, depending on how you run fetchmail (i.e., as root or as a lesser-privileged local user). The contents of this file are documented by the fetchmail(1) man page, which can be consulted using the “man fetchmail” command. You will need an entry such as this one:

poll pop.gmail.com with proto POP3
user 'eric.schmidt@gmail.com' there with password 'xxxxxxxx' is eric here
options keep ssl sslfingerprint '59:51:61:89:CD:DD:B2:35:94:BB:44:97:A0:39:D5:B4'
sslcertck sslcertpath /usr/share/ssl/certs

Add any other option according to your preferences. If other family members also have a Gmail account and this is root's .fetchmailrc file, you can add similar three-line user subsections under this same poll section; the last two lines will redundantly be identical for every Gmail account.

The specified password is that of the Gmail account, not the local user's password. Since this configuration file contain passwords, it must be non-world-readable:

sh# chmod 600 $HOME/.fetchmailrc

The MD5 fingerprint is that of the “pop.gmail.com” server certificate delivered by the Gmail POP3-over-SSL server, not that of the “Equifax Secure Certificate Authority” root certificate.

Note that this will not be enough to perform certificate-revocation-list (CRL) verifications, which fetchmail/OpenSSL does not support; however, this shortcoming is somewhat mitigated by the MD5 fingerprint verification, at the price of a loss in unattended flexibility (should Gmail wish to change its server certificate for some unlikely reason).

There is no need to inform fetchmail that the POP3-over-SSL (pop3s) TCP port is 995; it's smart enough to figure it out on its own.

Note that POP3-over-SSL is not the same as regular (non-SSL) POP3 with use of the STLS command and capability (i.e., RFC 2595's POP3 STARTTLS extension), which Gmail does not support.
6.

You should be able to test this with

sh# fetchmail -d0 -v pop.gmail.com

once you complete the email-forwarding/email-delivery part of fetchmail's configuration and integration (which is beyond the email-retrieval scope of this help document).
7.

The Gmail POP3-over-SSL server specifies that it does not want to be polled more than once every five minutes (i.e., 300 seconds), as can be verified by executing the following command:

sh$ openssl s_client -connect pop.gmail.com:995 -CApath /usr/share/ssl/certs -quiet
depth=1 /C=US/O=Equifax/OU=Equifax Secure Certificate Authority
verify return:1
depth=0 /C=US/ST=California/L=Mountain View/O=Google Inc./CN=pop.gmail.com
verify return:1
+OK Gpop x99xx9999xxx ready.
CAPA
+OK Capability list follows
USER
RESP-CODES
EXPIRE 0
LOGIN-DELAY 300
X-GOOGLE-VERHOEVEN
.
USER eric.schmidt@gmail.com
+OK send PASS
PASS xxxxxxxx
+OK Welcome.
CAPA
+OK Capability list follows
USER
RESP-CODES
PIPELINING
EXPIRE 0
LOGIN-DELAY 300
TOP
UIDL
X-GOOGLE-VERHOEVEN
.
QUIT
+OK Farewell.
read:errno=0

(Authenticating is not strictly necessary for this test. It was done to show how Gmail's POP3 server presents a different list of capabilities before and after login.)

Make sure to respect this delay if automatic polling is configured. This can be achieved by specifying “set daemon 300” in the .fetchmailrc file, or by specifying “-d 300” on the fetchmail command line, where 300 can be replaced by a greater number if desired.

* Did you click ‘Save Changes’ after enabling POP in Gmail? To ensure that Gmail can communicate with your mail client, be sure to click ‘Save Changes’ on the Gmail ‘Mail Settings’ page.

==Referensi==

* http://download.gna.org/hpr/fetchmail/FAQ/gmail-pop-howto.html

==Pranala Menarik==

* [[Linux Howto]]

@@ Line 67: / Line 67: @@
   fetchmail: Issuer CommonName: Google Internet Authority
   fetchmail: Server CommonName: pop.gmail.com
-  fetchmail: pop.gmail.com key fingerprint: 6B:C4:63:05:87:1E:72:88:ED:81:C5:A2:51:6B:B7:B6
+  fetchmail: pop.gmail.com key fingerprint: 90:9A:84:92:E7:60:7C:A2:45:73:C9:11:D7:FE:7D:8A
 Catat baik-baik fingerprint-nya dah copyka ke file .fetchmailrc sebagai berikut
@@ Line 75: / Line 76: @@
   poll pop.gmail.com with proto POP3 service 995
     user 'eric.schmidt@gmail.com' there with password 'xxxxxxxx' is eric here
-    options keep ssl sslfingerprint '6B:C4:63:05:87:1E:72:88:ED:81:C5:A2:51:6B:B7:B6'
+    options keep ssl sslfingerprint '90:9A:84:92:E7:60:7C:A2:45:73:C9:11:D7:FE:7D:8A'
     sslcertck sslcertpath /usr/share/purple/ca-certs

@@ Line 3: / Line 3: @@
   poll pop.gmail.com with proto POP3 service 995
     user 'eric.schmidt@gmail.com' there with password 'xxxxxxxx' is eric here
-    options keep ssl sslfingerprint '92:73:17:4C:34:4B:68:F7:B2:17:71:42:0D:7F:9F:33'
+    options keep ssl sslfingerprint '6B:C4:63:05:87:1E:72:88:ED:81:C5:A2:51:6B:B7:B6'
     sslcertck sslcertpath /usr/share/purple/ca-certs
@@ Line 62: / Line 62: @@
 Sertifikat server tidak perlu di simpan di mana-mana.
-* Fetchmail client tidak perlu memperlihatkan sertifikat client. Melainkan, authentifikasi client dilakukan menggunakan perintah USER dan PASS pada  [[post-office-protocol version 3]] ([[POP3]]) pada sambungan [[SSL]], pada saat dia tersambung dengan baik.
+* Fetchmail client tidak perlu memperlihatkan sertifikat client. Melainkan, authentifikasi client dilakukan menggunakan perintah USER dan PASS pada  [[post-office-protocol version 3]] ([[POP3]]) pada sambungan [[SSL]], pada saat dia tersambung dengan baik. Biasanya akan tampak
 * Edit .fetchmailrc, gunakan entry sebagai berikut:
@@ Line 68: / Line 75: @@
   poll pop.gmail.com with proto POP3 service 995
     user 'eric.schmidt@gmail.com' there with password 'xxxxxxxx' is eric here
-    options keep ssl sslfingerprint '92:73:17:4C:34:4B:68:F7:B2:17:71:42:0D:7F:9F:33'
+    options keep ssl sslfingerprint '6B:C4:63:05:87:1E:72:88:ED:81:C5:A2:51:6B:B7:B6'
     sslcertck sslcertpath /usr/share/purple/ca-certs
@@ Line 89: / Line 96: @@
 * [[Linux Howto]]

@@ Line 9: / Line 9: @@
   chmod 600 ~/.fetchmailrc
@@ Line 27: / Line 32: @@
   sudo su -
   cd /usr/share/purple/ca-certs
   wget -O Equifax_Secure_Certificate_Authority.pem \

← Older revision		Revision as of 04:00, 16 January 2010
Line 1:		Line 1:
		+	* Edit .fetchmailrc, gunakan entry sebagai berikut:
		+
		+	poll pop.gmail.com with proto POP3 service 995
		+	user 'eric.schmidt@gmail.com' there with password 'xxxxxxxx' is eric here
		+	options keep ssl sslfingerprint '92:73:17:4C:34:4B:68:F7:B2:17:71:42:0D:7F:9F:33'
		+	sslcertck sslcertpath /usr/share/purple/ca-certs
		+
		+	* Pastikan bahwa
		+
		+	chmod 600 ~/.fetchmailrc
		+
		+
		+	==Langkah yang lebih lengkap; tapi tidak perlu kayanya==
		+
	Langkah untuk mengkonfigurasi fetchmail agar dapat mengambil gmail adalah sebagai berikut:		Langkah untuk mengkonfigurasi fetchmail agar dapat mengambil gmail adalah sebagai berikut:

@@ Line 45: / Line 45: @@
 * Edit .fetchmailrc, gunakan entry sebagai berikut:
-poll pop.gmail.com with proto POP3 service 995
+ poll pop.gmail.com with proto POP3 service 995
     user 'eric.schmidt@gmail.com' there with password 'xxxxxxxx' is eric here
     options keep ssl sslfingerprint '92:73:17:4C:34:4B:68:F7:B2:17:71:42:0D:7F:9F:33'

@@ Line 1: / Line 1: @@
-Configuring your incoming email client for Gmail: fetchmail
+Langkah untuk mengkonfigurasi fetchmail agar dapat mengambil gmail adalah sebagai berikut:
-.
+* [http://mail.google.com/support/bin/answer.py?hl=en&answer=13273 Enable POP di account Gmail]
-      Enable POP in your Gmail account.
+ locate .pem
 .

@@ Line 112: / Line 112: @@
 * http://download.gna.org/hpr/fetchmail/FAQ/gmail-pop-howto.html
 ==Pranala Menarik==
 * [[Linux Howto]]