#protonmail #ubuntu #linux
Currently protonmail bridge for linux is distributed as part of an open beta program, but soon it will be made public (https://protonmail.com/bridge/install).
Consider that the bridge linux client requires a paid protonmail account to work.
Download the latest package into your computer.
wget https://protonmail.com/download/bridge/protonmail-bridge_1.6.9-1_amd64.deb
The link above is working at the time of writing this article, but as the bridge team pointed out, they will expire all the previous links once they release a new version to encourage the installation of the latest version.
To get the latest version try replacing/increasing the version numbers on the link provided or write an email to [email protected] (https://protonmail.com/support/knowledge-base/bridge-for-linux/)
We will need root access for the setup
sudo -i
Install the protonmail bridge client
dpkg -i protonmail-bridge_1.6.9-1_amd64.deb
Install the "pass" password manager that protonmail bridge will use to store the passwords
apt install pass -y
Install the "screen" utility to daemonize the protonmail bridge client
apt install screen -y
We will create a new user mainly to isolate the access to the passwords of other users.
Notice that the new user will be locked to disable access to this user from outside.
useradd protonmail
usermod -L protonmail (locks the user)
mkdir -p /home/protonmail
chown -R protonmail:protonmail /home/protonmail
Login as the new isolated user
su protonmail
cd ~
Run a script session to avoid the PGP key passphrase prompt to fail (https://bugzilla.redhat.com/show_bug.cgi?id=659512).
This is required if we are not using a graphical interface due to the way our isolated user runs the shell commands
script /dev/null
Generate PGP key pair for the new user with an empty passphrase.
The empty passphrase is required to run the protonmail bridge on the background on system startup without being prompted for the password and hence causing the process to fail.
gpg --full-gen-key
>>>> Choose 1 (1) RSA and RSA (default)
>>>> Choose 4096 4096
>>>> Choose 0 0 = key does not expire
>>>> Type your name e.g. Proty McProtonFace
>>>> Type your email e.g. [email protected]
>>>> Leave empty comment
>>>> Leave empty passphrase
List the keys to ensure they were created correctly
gpg --list-keys
Init the password manager for the chosen email address in the PGP keys step
pass init [email protected]
At this point we already set up the password manager that will allow the protonmail bridge to store the passwords so we will now setup your protonmail account.
protonmail-bridge --cli
>>>> add (add your protonmail account to bridge)
>>>> (enter your protonmail account email address)
>>>> (enter your protonmail account password)
>>>> list (list configured accounts)
>>>> info (list SMTP credentials for configuring any local SMTP compatible service)
>>>> help (get familiarized with the bridge options)
>>>> exit (exit the bridge console which stops the local SMTP server created)
Exit the scripted mode of the isolated user if you previously ran "script /dev/null"
exit
In order to start automatically the bridge client on system startup we will create a script to run it in the background.
Notice that we will use the "screen" utility since there is no way to run the protonmail linux client in the background currently without a graphical interface.
For this we will need root access again.
exit
Create a basic script that will be able to launch the protonmail bridge client in the background and kill it.
mkdir /var/lib/protonmail
nano /var/lib/protonmail/protonmail.sh
(copy the content of the file and save)
chmod +x /var/lib/protonmail/protonmail.sh
Create a systemd service
nano /etc/systemd/system/protonmail.service
(copy the content of the file and save)
Enable the script so that it can run on system startup
systemctl enable protonmail
Test the protonmail service
systemctl start protonmail
netstat -tulpn | grep 1025
Reboot you system and check if protonmail bridge is bound to the default ports
reboot
netstat -tulpn | grep 1025
Configure the mail app with the info from the info command above.
Also add this to your config.php in Nextcloud
'app.mail.verify-tls-peer' => false,