#protonmail #debian #linux
Currently protonmail bridge for linux is distributed as part of an open beta program, but soon it will be made public (https://protonmail.com/bridge/install).
Consider that the bridge linux client requires a paid protonmail account to work.
Download the latest package into your computer.
wget --no-check-certificate https://protonmail.com/download/bridge/protonmail-bridge_2.1.3-1_amd64.deb
The link above is working at the time of writing this article, but as the bridge team pointed out, they will expire all the previous links once they release a new version to encourage the installation of the latest version.
To get the latest version try replacing/increasing the version numbers on the link provided or write an email to [email protected] (https://protonmail.com/support/knowledge-base/bridge-for-linux/)
We will need root access for the setup
su root
Import the protonmail bridge public key
nano bridge_pubkey.gpg
(copy the content of the file and save) or the public key bridge_pubkey.gpg can found:https://protonmail.com/download/bridge_pubkey.gpg
rpm --import bridge_pubkey.gpg
Download the protonmail-bridge package
cd /tmp
wget --no-check-certificate https://protonmail.com/download/bridge/protonmail-bridge_2.1.3-1_amd64.deb
Check the rpm package is correctly signed
rpm --checksig protonmail-bridge_2.1.3-1_amd64.deb
Install dependencies for protonmail-bridge
apt install qt5-default libqt5designer5 libqt5multimediawidgets5 libqt5quickwidgets5 libpulse-mainloop-glib0 libsecret-1-0 ttf-dejavu net-tools libsecret-common libsecret-tools
Install the protonmail bridge client
dpkg -i protonmail-bridge_2.1.3-1_amd64.deb
Install the "pass" password manager that protonmail bridge will use to store the passwords
apt install pass
Install the "screen" utility to daemonize the protonmail bridge client
apt install screen
We will create a new user mainly to isolate the access to the passwords of other users.
Notice that the new user will be locked to disable access to this user from outside.
useradd protonmail
usermod -L protonmail
Create a protonmail directory in /home
cd /home
mkdir protonmail
Change folder owner
chown -R protonmail:protonmail /home/protonmail
Login as the new isolated user
su protonmail
cd ~
Run a script session to avoid the PGP key passphrase prompt to fail (https://bugzilla.redhat.com/show_bug.cgi?id=659512).
This is required if we are not using a graphical interface due to the way our isolated user runs the shell commands
script /dev/null
Generate PGP key pair for the new user with an empty passphrase.
The empty passphrase is required to run the protonmail bridge on the background on system startup without being prompted for the password and hence causing the process to fail.
gpg --full-generate-key
>>>> Choose 1 (1) RSA and RSA (default)
>>>> Choose 2048 (default)
>>>> Choose 0 0 = key does not expire
>>>> Type your name e.g. Proty McProtonFace
>>>> Type your email e.g. [email protected]
>>>> Leave empty comment
>>>> Leave empty passphrase
List the keys to ensure they were created correctly
gpg --list-keys
Init the password manager for the chosen email address in the PGP keys step
pass init [email protected]
At this point we already set up the password manager that will allow the protonmail bridge to store the passwords so we will now setup your protonmail account.
protonmail-bridge --cli
>>>> add (add your protonmail account to bridge)
>>>> (enter your protonmail account email address)
>>>> (enter your protonmail account password)
>>>> list (list configured accounts)
>>>> info (list SMTP credentials for configuring any local SMTP compatible service)
>>>> help (get familiarized with the bridge options)
>>>> exit (exit the bridge console which stops the local SMTP server created)
Exit the scripted mode of the isolated user if you previously ran "script /dev/null"
exit
In order to start automatically the bridge client on system startup we will create a script to run it in the background.
Notice that we will use the "screen" utility since there is no way to run the protonmail linux client in the background currently without a graphical interface.
For this we will need root access again.
exit
Create a basic script that will be able to launch the protonmail bridge client in the background and kill it.
mkdir /var/lib/protonmail
nano /var/lib/protonmail/protonmail.sh
(copy the content of the file and save)
chmod +x /var/lib/protonmail/protonmail.sh
Create a systemd service
nano /etc/systemd/system/protonmail.service
(copy the content of the file and save)
Enable the script so that it can run on system startup
systemctl enable protonmail
Test the protonmail service
systemctl start protonmail
netstat -tulpn | grep 1025
Reboot you system and check if protonmail bridge is bound to the default ports
reboot
netstat -tulpn | grep 1025
All the instructions above should work in Fedora. You can replace "yum" commands with "dnf"
Now that you have the protonmail bridge running in the background you can configure SMTP emails on local instances of Jenkins, Jira, Bitbucket, Thunderbird or any service of your choice.
Remember that required credentials and configuration details can be found by executing:
protonmail-bridge --cli
>>>> info
>>>> exit
Note: When sending an email via PHPMailer, the following message is displayed:
Connection failed. Error #2: stream_socket_client(): unable to connect to 127.0.0.1:1026 (Connection refused)
SMTP ERROR: Failed to connect to server: Connection refused (111)
OR
SMTP INBOUND: "454 4.7.0 account is logged out, use the app to login again"
SERVER -> CLIENT: 454 4.7.0 account is logged out, use the app to login again
SMTP ERROR: Password command failed: 454 4.7.0 account is logged out, use the app to login again
SMTP Error: Could not authenticate.
Solution 1 :
More than one process listens on the same port. Changing the port in Protonmail-bridge may correct the problem.
To solve it I had to: Login as the new isolated user
su protonmail
cd ~
This is required if we are not using a graphical interface due to the way our isolated user runs the shell commands
script /dev/null
Change port setting
change port
Solution 2 :
Two user processes (root and protonmail) are executed at the same time.
- Stopping the "proton-bridge" process using the killall command
killall -9 proton-bridge
- Full uninstall protonmail-bridge
apt purge protonmail-bridge
-
remove all protonmail folders and configuration files in the 'root' profile
-
remove the protonmail folder in the "home" folder
rm -rf /home/protonmail
-
reboot
-
Repeat the protonmail-bridge installation procedure
Note: When running Bridge on command line, I the following message is printed:
WARN[0000] Failed to add test credentials to keychain error="exit status 1: gpg: Passwords: skipped: No public key\ngpg: [stdin]: encryption failed: No public key\nPassword encryption aborted.\n" helper="*pass.Pass"
He had a bug with your keyring and pass.
Solution:
To solve it I had to:
- uninstall gnupg and pass
apt remove gnupg pass
- delete the
.gnupgand.password-storefolders
rm -rf /home/protonmail/.gnupg
rm -rf /home/protonmail/.password-store
- reinstall gnupg and pass
apt install gnupg pass
- login as the new isolated user
su protonmail
cd ~
- run a script session to avoid the PGP key passphrase prompt to fail
script /dev/null
- run gpg to create the database and its folder
gpg --list-keys
- create a new key
gpg --full-generate-key
>>>> Choose 1 (1) RSA and RSA (default)
>>>> Choose 2048 (default)
>>>> Choose 0 0 = key does not expire
>>>> Type your name e.g. Proty McProtonFace
>>>> Type your email e.g. [email protected]
>>>> Leave empty comment
>>>> Leave empty passphrase
- Init the password manager for the chosen email address in the PGP keys step
pass init [email protected]
- List the keys to ensure they were created correctly
gpg --list-keys
- Setup the protonmail bridge client, follow the procedure I described here
A couple thoughts here, as I'm trying to get this to work in a very low-memory system, so I don't really want a desktop environment running. This is a single-purpose VM, so I'm just using my user account. This VM is a Debian 12 server, with their GNOME desktop installed as well. I think all the packages above were OK, but I believe I also had to install
dbus-x11.This is a better way to generate gpg keys, without needing
scriptor a separate--batchfile. Replace USER with your email or something:$ gpg --batch --passphrase '' --quick-gen-key USER default defaultCheck & activate the key as above.
Now I had to log into the actual desktop, which was really slow. The application
"Passwords and Keys"wasn't installed by default, so I added that. Once you run it, you can right-click on the "login" keyring, and select "Change password". It'll ask for your user password, and then you can leave the new password fields blank. It warns you this is a terrible idea, but again, single-purpose VM.Since I don't want gnome-desktop & such using up my memory, you can disable X11 on boot via:
$ sudo systemctl set-default multi-user.targetTo re-enable:
$ sudo systemctl set-default graphical.targetReboot, and give everything a try.
As a side note, I'm using
getmail6to backup up my email, and it doesn't speakSTARTTLS, but there's an un-documented CLI command to switch to just "SSL":>>> change imap-securityOf course, this option is available in the GUI client, so it's not a hack or anything. There's a similar option for SMTP, but I'm not using this for outgoing mail.
Hope this helps! And also that my notes are accurate!