After moving to a new AWS server I discovered that my mail configuration files were not configured as part of my backup service on my old server. In addition my new server is using sendmail instead of postfix for mail services. That mean re-learning and re-discovering how to setup mail relay through gmail.
Cloud servers tend to be blacklisted. Sure enough, my IP address on the new server is on the Spamhaus PBL list. While Amazon allows for elastic IP addresses, a quasi-permanent IP address that acts like a static IP, which can be added to the whitelist on the Spamhaus PBL it is not the best option. Servers change, especially in the cloud. I find the best option is to route email through a trusted email service. I use Google Business Apps email accounts and have one setup just for this purpose. Now to configure sendmail to re-route all outbound mail from my server to my gmail account.
Configuring Amazon Linux
Here are my cheat-sheet notes about getting an Amazon Linux (RHEL flavor of Linux) box to use the default sendmail to push content through gmail.
Install packages needed.
# sudo su - # yum install cyrus-sasl ca-certificates sendmail make
Create your certificates
This is needed for the TLS authentication.
</p> # cd /etc/pki/tls/certs # make sendmail.pem # cd /etc/mail # mkdir certs # chmod 700 certs # cd certs # cp /etc/pki/tls/certs/ca-bundle.crt /etc/mail/certs/ca-bundle.crt # cp /etc/pki/tls/certs/sendmail.pem /etc/mail/certs/sendmail.pm
Setup your authinfo file
The AuthInfo entries start with the relay server host name and port.
U = the AWS server user that will be the source of the email.
I = your gmail user name, if using business apps it is likely @yourdomain.com not @gmail.com
P = your gmail email password
M = the method of authentication, PLAIN will suffice
# cd /etc/mail # vim gmail-auth AuthInfo:smtp-relay.gmail.com "U:ec2-user" "I:email@example.com" "P:yourpassword" "M:PLAIN" AuthInfo:smtp-relay.gmail.com "U:apache" "I:firstname.lastname@example.org" "P:yourpassword" "M:PLAIN" AuthInfo:smtp-relay.gmail.com:587 "U:ec2-user" "I:email@example.com" "P:yourpassword" "M:PLAIN" AuthInfo:smtp-relay.gmail.com:587 "U:apache" "I:firstname.lastname@example.org" "P:yourpassword" "M:PLAIN" # chmod 600 gmail-auth # makemap -r hash gmail-auth < gmail-auth
Edit the sendmail.mc file and run make to turn it into a sendmail.cf configuration file. Look for each of the entries noted in the sendmail.mc comments. Uncomment the entries and/or change them as noted. A couple of new lines will need to be added to the sendmail.mc file. I add the new lines just before the MAILER(smpt)dnl line at the end of the file.
Most of these exist throughout the file and are commented out. I uncommented the lines and modified them as needed so they appear near the comment blocks that explain what is going on:
# vim /etc/mail/sendmail.mc define(`SMART_HOST', `smtp-relay.gmail.com')dnl define(`confAUTH_OPTIONS', `A p')dnl TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl define(`confCACERT_PATH', `/etc/mail/certs')dnl define(`confCACERT', `/etc/mail/certs/ca-bundle.crt')dnl define(`confSERVER_CERT', `/etc/mail/certs/sendmail.pem')dnl define(`confSERVER_KEY', `/etc/mail/certs/sendmail.pem')dnl
Add these lines to the end of sendmail.mc just above the first MAILER()dnl entries:
</p> <p style="padding-left: 30px;">define(`RELAY_MAILER_ARGS', `TCP $h 587')dnl</p> <p style="padding-left: 30px;">define(`ESMTP_MAILER_ARGS', `TCP $h 587')dnl</p> <p style="padding-left: 30px;">FEATURE(`authinfo',`hash -o /etc/mail/gmail-auth.db')dnl</p> <p style="padding-left: 30px;">
If you are using business apps you may need these settings to make the email come from your domain and to pass authentication based on your Gmail relay settings. These are also in sendmail.mc:
MASQUERADE_AS(`charlestonsw.com')dnl FEATURE(masquerade_envelope)dnl FEATURE(masquerade_entire_domain)dnl MASQUERADE_DOMAIN(localhost)dnl MASQUERADE_DOMAIN(localhost.localdomain)dnl MASQUERADE_DOMAIN(charlestonsw.com)dnl
Make the configuration-helper into a sendmail.mc file and restart sendmail:
# make # service sendmail restart
Configure Gmail Services
This is for business apps users, you need to turn on relay.
Go to “manage this domain” for your business apps account.
Go to “Google Apps”.
Click on “Gmail”.
Click “advanced settings”.
Find the “SMTP relay service” entry. Add a new entry.
Only addresses in my domain, require SMTP, require TLS all need to be selected.
Give it a name.