Mail relay with ProtonMail
Environment used for this Guide
I set-up my server with the latest stable Debian Network install minimal CD (currently bullseye) and add the meta package progress-linux maintained by the Linux and Infrastructure Team of the Bern University of applied sciences - my first employer in Switzerland.
Download ProtonMail Bridge .deb
Get the .deb file
Install required packages
apt -y install pass libsasl2-2
Install the bridge and configure it
apt install ./protonmail-bridge_2.3.0-1_amd64.deb
It will install many additional packages that are only installed as this is mainly a GUI based software :(.
Create a passphrase-free GPG key non-interactively
gpg --batch --passphrase '' --quick-gen-key 'ProtonMail Bridge' default default never
The above command creates a basic GPG key, and its ID is ProtonMail Bridge.
This key does not have a passphrase, so pass does not need to ask users for a passphrase whenever it tries to use the key.
The key does not expire. Don’t use this key for other things (such as encryption, signing, identity, etc.). It is not safe.
This creates a new password database in pass (pass calls the database password store). And the GPG key ProtonMail Bridge can be used to open the database.
pass init “ProtonMail Bridge”
The planned way to run ProtonMail Bridge, in the background like the Postfix mail server, does not allow users to interact with the protonmail-bridge daemon. We have to set up protonmail-bridge interactively in advance.
Start the bridge for the inital login and configuration
hostname#protonmail-bridge --cli Welcome to Proton Mail Bridge interactive shell ___....___ ^^ __..-:'':__:..:__:'':-..__ _.-:__:.-:'': : : :'':-.:__:-._ .':.-: : : : : : : : : :._:'. _ :.': : : : : : : : : : : :'.: _ [ ]: : : : : : : : : : : : : :[ ] [ ]: : : : : : : : : : : : : :[ ] ::::::::[ ]:__:__:__:__:__:__:__:__:__:__:__:__:__:[ ]:: !!!!!!!![ ]!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!![ ]!! ^^^^^^^^[ ]^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^[ ]^^ [ ] [ ] [ ] [ ] jgs [ ] [ ] ~~^_~^~/ \~^-~^~ _~^-~_^~-^~_^~~-^~_~^~-~_~-^~_^/ \~ >>>login Username: [UsernameToLoginToProtonMail] Password: [PasswordIsVerySecretAndComplex!1!Jaw0hl?]
After logging in with
login and providing the 2nd factor you surely have enabled with Proton Mail, get the required SMTP/IMAP credentials to use the ProtonMail Bridge on the device you installed the bridge with
[ ] [ ] jgs [ ] [ ] ~~^_~^~/ \~^-~^~ _~^-~_^~-^~_^~~-^~_~^~-~_~-^~_^/ \~ >>> info Configuration for YourDefaultEmailOnYourPaidAccount@proton.me IMAP Settings Address: 127.0.0.1 IMAP port: 1143 Username: [YourDefaultEmailOnYourPaidAccountproton.me] Password: wzRrv5R6xOREfmcQ12837ASUDFiudfhsai Security: STARTTLS SMTP Settings Address: 127.0.0.1 SMTP port: 1025 Username: [YourDefaultEmailOnYourPaidAccountproton.me] Password: wzRrv5R6xOREfmcQ12837ASUDFiudfhsai Security: STARTTLS >>>
Set-up bridge as service
Setting up the ProtonBridge Client as a Linux service that will always run and be restarted after e.g. a reboot
Add this to the file
[Unit] Description=Protonmail client bridge service [Service] Type=simple StandardOutput=journal ExecStart=/usr/bin/protonmail-bridge --noninteractive User=<name of the login with which you login to your server> [Install] WantedBy=default.target
Now enable and start protonmailbridge as a service
systemctl enable protonmailbridge
systemctl start protonmailbridge
Maybe you need to use
sudo if you are not working as root, which you are not, right?!
If there are any error messages, check if the service is up and running, if so - errors can be ignored.
<user>@hostname:~# ss -plant | grep 1025 LISTEN 0 4096 127.0.0.1:1025 0.0.0.0:* users:(("proton-bridge",pid=859038,fd=11))
- Required packes are installed
- ProtonMail Bridge installed
- ProtonMail Bridge running a Service
- Port listening on 1025/TCP
- We know the required User and Password for Postfix
Install and configure Postfix
apt -y install mailutils postfix
Edit the postfix main.cf file
In this file search for relayhost and edit the line to look like
relayhost = [127.0.0.1]:1025
To allow Postfix use the ProtonMail Bridge with the required encryption details add the following to main.cf
smtp_sasl_auth_enable = yes smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd smtp_sasl_security_options = noanonymous smtp_tls_CApath = /etc/ssl/certs smtp_use_tls = yes sender_canonical_maps = regexp:/etc/postfix/canonical
The canonical file needs to be updated so we have a default
Add the following
/.*/ YourProtonEmilAddress here or your custom Emailaddress
Now save the account details you received from the ProtonMail Bridge, these are different than you login for the website at https://mail.proton.me/
Now protect this file from users that should not know these credentials
chmod 0600 /etc/postfix/sasl_passwd chown root:root /etc/postfix/sasl_passwd
Run Postmap to generate the DB file
As Postfix will be connecting to the bridge with STARTSSL, it will need to validate the bridge certificate.
Symlinking the self-signed certificate will be necessary:
ln -s /user/.config/protonmail/bridge/cert.pem /etc/ssl/certs/protonmail-bridge.pem
At this point your postfix config has been complete and postfix needs a restart
systemctl restart postfix
If the services using this relay are not on the server you configured Postfix and the ProtonMail Bridge on, e.g. your home LAN or LAB LAN, allow then to use Postfix as relay by adding to open up the networks in /etc/postfix/main.cf
Edit the line
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
Add extra networks as needed
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/24 10.10.0.0/16
Restart postfix for this to take effect.
systemctl restart postfix
Now test the setup by feeding a simple Email to Postfix
user@server:~# echo "this is the body" | mail -r "MustBeAnExistingEmail@proton.me" -s "this is the subject " "RecepientOfThisTestMail@internet.invalid"
You can check the forwarding by postfix to the ProtonMain Bridge in the Log
tail -f /var/log/mail.log
Any error messages should provide you with enough clues to find a solution via e.g. Google Foo or you preffered search engine.