Hello all.
The goal of this guide is to provide you with a split-protonmail setup made of a minimal mail template and three AppVMs: protonmail-bridge, mail-receive, and mail-send.
This will allow you to effectively separate incoming and outgoing mail, and your protonmail credentials.
This guide was inspired by a [Reddit post](https://web.archive.org/web/20210630065228/https://www.reddit.com/r/Qubes/comments/oarnuj/qubes_os_protonmail_bridge_paranoid_isolation_my/) to which I made with some modifications, since the original post didn't quite work for me.
| Hello all.
The goal of this guide is to provide you with a split-protonmail setup made of a minimal mail template and three AppVMs: `protonmail-bridge`, `mail-receive`, and `mail-send`.
This will allow you to effectively separate incoming and outgoing mail (into non-networked qubes), and your protonmail credentials (security by compartmentalization).
This guide was inspired by a [Reddit post](https://web.archive.org/web/20210630065228/https://www.reddit.com/r/Qubes/comments/oarnuj/qubes_os_protonmail_bridge_paranoid_isolation_my/) to which I made some modifications, since the configuration proposed in the original post didn't quite work for me.
|
Note: I'm not an expert, so I'm sharing what worked for me. If you have suggestions or modification proposals, feel free to post them.
| Note 1: I'm not an expert, so I'm sharing what worked for me. If you have suggestions or modification proposals, feel free to post them.
|
Note 2: Protonmail Bridge is currently only available for paid accounts.
| Note 2: Protonmail Bridge is currently only available to Protonmail paid accounts.
|
Note 2: you can take this a step further by creating a template for Protonmail bridge, and another one for Thunderbird. In this example, I use only one template for both purposes.
Note 3: I'm using a `debian-11-minimal` template, I haven't tested Fedora.
| Note 2: you can take this a step further by creating a template for Protonmail bridge, and another one for Thunderbird. For simplicity, in this example, I use only one template for both purposes.
Note 3: I'm using a `debian-11-minimal` template, I haven't tested this setup with Fedora.
|
2. Clone the minimal template, and update it:
| 2. Clone the minimal template:
|
dom0 $ qvm-clone debian-11-minimal debian-11-protonmail
dom0 $ qvm-run -u root --pass-io debian-11-protonmail "apt update && apt full-upgrade -y"
| [user@dom0]$ qvm-clone debian-11-minimal debian-11-protonmail
|
3. Create a `packages.txt` file, type them by hand or use whatever method you prefer to install the following packages:
| 3. Update the new clone:
Note 1: those of you who set up a `apt-cacher-ng` qube might need to update the urls of the repositories. Expand the section below for the commands
[details="Howto: Update repo urls to work with `apt-cacher-ng`"]
```
[root@debian-11-protonmail]# sed -i 's#https://#http://HTTPS///#g' /etc/apt/sources.list
[root@debian-11-protonmail]# sed -i 's#https://#http://HTTPS///#g' /etc/apt/sources.list.d/*.list
```
[/details]
```
[root@debian-11-protonmail]# apt update && apt full-upgrade -y
```
4. Create a `packages.txt` file, type them or use whatever method you prefer to install the following packages:
|
debian-11-protonmail # apt install -y --no-install-recommends $(cat packages.txt)
| [root@debian-11-protonmail]# apt install -y --no-install-recommends $(cat packages.txt)
|
4. Download and install Protonmail Bridge, then shutdown the qube:
| 5. Download and install Protonmail Bridge, then shutdown the qube:
|
debian-11-protonmail # https_proxy=http://127.0.0.1:8082/ http_proxy=http://127.0.0.1:8082/ wget https://protonmail.com/download/bridge/protonmail-bridge_2.1.1-1_amd64.deb
debian-11-protonmail # dpkg -i protonmail-bridge_*_amd64.deb && shutdown
| [root@debian-11-protonmail]# https_proxy=http://127.0.0.1:8082/ http_proxy=http://127.0.0.1:8082/ wget https://protonmail.com/download/bridge/protonmail-bridge_2.1.1-1_amd64.deb
[root@debian-11-protonmail]# dpkg -i protonmail-bridge_*_amd64.deb && shutdown
|
Note 2: I included a maxmem value that works for me. Keep in mind you can always adjust as needed.
| Note 2: I included a maxmem value that works for me. You can always adjust as needed.
|
dom0 $ qvm-create --class=AppVM --template=debian-11-protonmail --label=blue protonmail-bridge
dom0 $ qvm-prefs protonmail-bridge maxmem 900
dom0 $ qvm-prefs protonmail-bridge netvm sys-whonix
| [user@dom0]$ qvm-create --class=AppVM --template=debian-11-protonmail --label=blue protonmail-bridge
[user@dom0]$ qvm-prefs protonmail-bridge maxmem 900
[user@dom0]$ qvm-prefs protonmail-bridge netvm sys-whonix
|
2. Create the policies:
| 2. Optional: set firewall to **Limit outgoing connections to**:
- `protonmail.ch`
- `protonmail.com`
3. Create the policies:
|
protonmail-bridge # mkdir -p /rw/usrlocal/etc/qubes-rpc
protonmail-bridge # echo 'socat STDIO TCP:localhost:1143' > /rw/usrlocal/etc/qubes-rpc/user.protonmail-imap
protonmail-bridge # echo 'socat STDIO TCP:localhost:1025' > /rw/usrlocal/etc/qubes-rpc/user.protonmail-smtp
| [root@protonmail-bridge]# mkdir -p /rw/usrlocal/etc/qubes-rpc
[root@protonmail-bridge]# echo 'socat STDIO TCP:localhost:1143' > /rw/usrlocal/etc/qubes-rpc/user.protonmail-imap
[root@protonmail-bridge]# echo 'socat STDIO TCP:localhost:1025' > /rw/usrlocal/etc/qubes-rpc/user.protonmail-smtp
|
3. Shutdown the VM:
| 4. Optional: add Protonmail Bridge to appmenu
|
dom0 $ qvm-shutdown --wait protonmail-bridge
| [user@dom0]$ qvm-features protonmail-bridge menu-items protonmail-bridge.desktop
[user@dom0]$ qvm-sync-appmenus protonmail-bridge
|
4. Optional: add protonmail bridge to appmenu
| 5. Shutdown the VM:
|
dom0 $ qvm-features protonmail-bridge menu-items protonmail-bridge.desktop
```
5. Optional: set firewall to Limit outgoing connections to:
- `protonmail.ch`
- `protonmail.com`
| [user@dom0]$ qvm-shutdown protonmail-bridge
```
|
dom0 $ qvm-create --class=AppVM --template=debian-11-protonmail --label=green mail-receive
dom0 $ qvm-prefs protonmail-receive maxmem 900
dom0 $ qvm-prefs protonmail-receive netvm ''
| [user@dom0]$ qvm-create --class=AppVM --template=debian-11-protonmail --label=green mail-receive
[user@dom0]$ qvm-prefs protonmail-receive maxmem 900
[user@dom0]$ qvm-prefs protonmail-receive netvm ''
|
2. Add startup command and shutdown:
| 2. Add the startup command:
|
mail-receive # echo 'qvm-connect-tcp ::1143' >> /rw/config/rc.local && shutdown
| [root@mail-receive]# echo 'qvm-connect-tcp ::1143' >> /rw/config/rc.local
|
3. Optional: add thunderbird to appmenu
| 3. Optional: add Thunderbird to appmenu
|
dom0 $ qvm-features mail-receive menu-items thunderbird.desktop
| [user@dom0]$ qvm-features mail-receive menu-items thunderbird.desktop
[user@dom0]$ qvm-sync-appmenus mail-receive
```
4. Shutdown the VM:
```
[user@dom0]$ qvm-shutdown mail-receive
|
dom0 $ qvm-create --class=AppVM --template=debian-11-protonmail --label=red mail-send
dom0 $ qvm-prefs protonmail-send maxmem 900
dom0 $ qvm-prefs protonmail-send netvm ''
| [user@dom0]$ qvm-create --class=AppVM --template=debian-11-protonmail --label=red mail-send
[user@dom0]$ qvm-prefs protonmail-send maxmem 900
[user@dom0]$ qvm-prefs protonmail-send netvm ''
|
2. Add startup command and shutdown::
| 2. Add the startup command:
|
mail-send # echo 'qvm-connect-tcp ::1025' >> /rw/config/rc.local && shutdown
| [root@mail-send]# echo 'qvm-connect-tcp ::1025' >> /rw/config/rc.local
|
3. Optional: add thunderbird to appmenu
| 3. Optional: add Thunderbird to appmenu
|
dom0 $ qvm-features mail-send menu-items thunderbird.desktop
| [user@dom0]$ qvm-features mail-send menu-items thunderbird.desktop
[user@dom0]$ qvm-sync-appmenus mail-send
```
4. Shutdown the VM:
```
[user@dom0]$ qvm-shutdown mail-send
|
dom0 # echo "mail-receive protonmail-bridge allow,target=protonmail-bridge" >> /etc/qubes-rpc/policy/user.protonmail-imap
dom0 # echo "mail-send protonmail-bridge ask,default_target=protonmail-bridge" >> /etc/qubes-rpc/policy/user.protonmail-smtp
dom0 # echo "mail-receive @default allow,target=protonmail-bridge" >> /etc/qubes-rpc/policy/qubes.ConnectTCP
dom0 # echo "mail-send @default ask,default_target=protonmail-bridge" >> /etc/qubes-rpc/policy/qubes.ConnectTCP
| [root@dom0]# echo "mail-receive protonmail-bridge allow,target=protonmail-bridge" >> /etc/qubes-rpc/policy/user.protonmail-imap
[root@dom0]# echo "mail-send protonmail-bridge ask,default_target=protonmail-bridge" >> /etc/qubes-rpc/policy/user.protonmail-smtp
[root@dom0]# echo "mail-receive @default allow,target=protonmail-bridge" >> /etc/qubes-rpc/policy/qubes.ConnectTCP
[root@dom0]# echo "mail-send @default ask,default_target=protonmail-bridge" >> /etc/qubes-rpc/policy/qubes.ConnectTCP
|
1. Start `protonmail-bridge`, login with your PM credentials and make sure that the bridge is set to run on startup (there's an option in the app settings).
2. Start `mail-receive`, add an account on thunderbird with the credentials provided by pm bridge. For IMAP use server 127.0.0.1, port 1143. For SMTP use 0.0.0.0. Connection security: STARTTLS, Normal Password. Then click advanced to save, and fetch mail.
3. Start `mail-send`, add an account on thunderbird with the credentials provided by pm bridge. For IMAP use server 0.0.0.0. For SMTP use server 127.0.0.1, port 1025. Connection security: STARTTLS, Normal Password. Then click advanced to save.
4. `mail-send` requires that you approve the pm certificate: you'll receive a prompt the first time you attempt to send an email. | 1. Start `protonmail-bridge`, login with your Protonmail credentials and make sure that the bridge is set to run on startup (there's an option in the app settings).
2. Start `mail-receive`, add an account on Thunderbird with the credentials provided by Protonmail bridge (**NOT your actual Protonmail credentials!**). For IMAP use server `127.0.0.1`, port `1143`. For SMTP use `0.0.0.0`. Connection security: `STARTTLS`, `Normal Password`. Then click on `Advanced settings` to save, and fetch mail.
3. Start `mail-send`, add an account on Thunderbird with the credentials provided by Protonmail bridge (**NOT your actual Protonmail credentials!**). For IMAP use server `0.0.0.0`. For SMTP use server `127.0.0.1`, port `1025`. Connection security: `STARTTLS`, `Normal Password`. Then click `Advanced settings` to save.
4. `mail-send` requires that you approve the Protonmail certificate: you'll receive a prompt the first time you attempt to send an email. |