This section describes setting up your POP client software to use the ssh forwarded connection. It's primary focus is fetchmail (ESR's excellent mail-retrieval and forwarding utility), since that is the most flexible software I have found for dealing with POP. fetchmail can be found at http://www.tuxedo.org/~esr/fetchmail/. It will do you a great service to read the excellent documentation that comes with fetchmail.
The following is my .fetchmailrc
defaults
user msingh is manish
no rewrite
poll localhost with protocol pop3 and port 11110:
preconnect "ssh -C -f msingh@popserver -L 11110:popserver:110 sleep 5"
password foobar;
Pretty simple, huh? fetchmail has a wealth of commands, but the key ones are
the preconnect line and the poll option.
We're not connecting directly to the POP server, but instead localhost and
port 11110. The preconnect does the forwarding each time fetchmail is run,
leaving open the connection for 5 seconds, so fetchmail can make it's own
connect. The rest fetchmail does itself.
So each time you run fetchmail, you're prompted for your ssh password for authentication. If you run fetchmail in the background (like I do), it's inconvenient to have to do that. Which brings us to the next section.
ssh can authenticate using many methods. One of these is an RSA public/private
key pair. You can generate an authentication key for your account using
ssh-keygen. An authetication key can have a passphrase associated with
it, or the passphase can be blank. Whether you want a passphrase depends on
how secure you think the account you are using locally is.
If you think your machine is secure, go ahead and have a blank passpharase.
Then the above .fetchmailrc works just by running fetchmail. You can
then run fetchmail in daemon mode when you dial up and mail is fetched
automatically. You're done.
However, if you think you need a passphrase, things get more complex. ssh
can run under control of an agent, which can register keys and
authenticate whatever ssh connections are made under it. So I have this
script getmail.sh:
#!/bin/sh
ssh-add
while true; do fetchmail --syslog --invisible; sleep 5m; done
When I dialup, I run:
$ ssh-agent getmail.sh
This prompts me for my passphrase once, then checks mail every 5 minutes. When the dialup connection is closed, I terminate ssh-agent. (This is automated in my ip-up and ip-down scripts)
What if I can't/don't want to use fetchmail? Pine, Netscape, and some other clients have their own POP mechanisms. First, consider using fetchmail! It's far more flexible, and mail clients shouldn't be doing that kind of stuff anyway. Both Pine and Netscape can be configured to use local mail systems.
But if you must, unless your client has a preconnect feature like fetchmail,
you're going to have to keep the ssh port forward active for the entire
time you're connected. Which means using sleep 100000000 to keep the
connection alive. This might not go over well with your network admins.
Secondly, some clients (like Netscape) have the port number hardcoded to 110. So you need to be root to do port forwarding from privledged ports. This is also annoying. But it should work.