PGPSENDMAIL(1)

NAME
PGPsendmail - drop-in wrapper to sendmail to allow PGP encryption

SYNOPSIS
pgpsendmail [ args ]

DESCRIPTION
The pgpsendmail programme is a drop-in wrapper to the standard Unix sendmail programme. pgpsendmail may operate in two basic modes. Each of these is described below:

If the PGPPATH environment variable does not exist, the real sendmail programme is executed with the same command line arguments. Hence, it is quite safe to move the original (real) /usr/lib/sendmail to /usr/lib/sendmail.real and place PGPsendmail as /usr/lib/sendmail since the system startup scripts (/etc/rc*) should not define PGPPATH. The operation of sendmail as a daemon is not affected. Also, users who do not use PGP are also completely unaffected (as they will not have a PGPPATH environment variable).

If the PGPPATH environment variable does exist, PGPsendmail will check all recipients in the message header (marked by "To: ", "Cc: " and "Bcc: " keywords) to determine if they have a PGP public key in the senders public keyring. By default, if all recipients have a public key, the message is encrypted for all recipients prior to transmission. The message is actually transmitted by the use of the real sendmail programme. If one or more recipients does not have PGP public key, the message is not encrypted. PGPsendmail extracts the Email address of a recipient when determining if a PGP public key is available.

CONFIGURATION
The configuration file $PGPPATH/PGPsendmail.config configures the pgpsendmail programme. It is a simple ASCII file with one configuration option per line. Each comment line must start with a leading '#' character. Comment lines and blank lines are ignored. Each configuration option is a keyword followed by zero or more parameters, depending on the option. The following configuration options are supported:

GLOBAL [flags...]
    This specifies global recipient processing flags. The flags are described in the next section. Only one line with the GLOBAL option is permitted. If you want multiple global flags, place them all in the same line. This restriction is silently enforced.

HEADER_TAIL_FILE file
    This will append the contents of file to the transmitted header. Note that this is done even if the message is not encrypted.

BODY_HEAD_FILE file
    This will insert the contents of file into the body of the message, if the message is encrypted. The contents of file are not encrypted.

ALIAS recipient [sysalias]
    This tells PGPsendmail that the system aliases database /etc/aliases should be used to expand an alias. If sysalias is provided, it is used as the system alias to search for. If sysalias is not provided, then recipient is used instead. Conventional comma-separated alias lists as well as sendmail ":include:path" lists are supported. Pipe directives are ignored. Each recipient in the expanded alias list will be processed according to the usual rules. Note that alias expansion by PGPsendmail does not modify the header passed to sendmail: it is only used to determine PGP userIDs. The real sendmail will still expand aliases as normal.

ADDRESSLOG logfile [searchfiles...]
    This will cause PGPsendmail to log each new email address (before recipient translation, see below) in the file logfile. PGPsendmail determines if an address is new by searching the optional searchfiles. These searchfiles follow the same format as that supported by match-email-addr. If you omit the searchfiles then the logfile will grow indefinately. You can use this facility to maintain a list of people you send messages to, which can be very useful with certain spam (junk email) filters. This option must come before any recipient translation options. You may place a leading "~/" in the filenames to specify files relative to your home directory. The "ADDRESSLOG" directive must come after all "ALIAS" directives.

recipient synonym [flags...]
    If the email address matches recipient it is translated to the string synonym. This is useful if the email address does not match the PGP user id of the recipient. The synonym must be a minimal, non-ambiguous match of the PGP user ID. The flags may be used to control how processing for this recipient is controlled.

!regexp synonym [flags...]
    If the email address matches the regular expression regexp it is translated to the string synonym. This is useful if the email address does not match the PGP user id of the recipient. The synonym must be a minimal, non-ambiguous match of the PGP user ID. The flags may be used to control how processing for this recipient is controlled.

RECIPIENT PROCESSING FLAGS

always-secure
    Always use encryption, bounce if can't encrypt.

secure
    Synonym for always-secure.

always
    Synonym for always-secure.

never-secure
    Never use encryption.

insecure
    Synonym for never-secure.

never
    Synonym for never-secure.

return-receipt
    Return a success message. NOTE: if you send a message where not all recipients have a PGP public key, and the always-secure flag is not set, there is *no* return message. The return-receipt flag is intended to give feedback whenever messages are successfully encrypted. This flag is in fact the default.

discard-receipt
    Do not return a success message.

no-receipt
    Synonym for discard-receipt.

add-key
    Include public key in message.

no-advertising
    Do not show advertising message about PGPsendmail.

sign
    Sign message before encrypting (needs PGPdaemon).

no-sign
    Don't sign message before encrypting.

DEBUGGING
To enable verbose debugging output from PGPsendmail, create the file $PGPPATH/PGPsendmail.debug. Upon each Email you send, the file /tmp/PGPsendmail.debug.<UID> will be over-written with a log for that message.

FILES
$PGPPATH/pubring.pgp
    the users' public keyring file
$PGPPATH/randseed.bin
    the seed file for PGP
$PGPPATH/PGPsendmail.config
    the users' configuration file
$PGPPATH/PGPsendmail.debug
    enable debugging if exists
/tmp/PGPsendmail.debug.<UID>
    debugging output file
pgpsendmail/doc/README.PGPsendmail
    distribution README (has more info.)

BUGS
PGPsendmail doesn't work with UCBMail and NeXTMail on the NEXTSTEP. It does work with Pine and Rnmail.

SEE ALSO
sendmail(8), pgp(1), pgpdaemon(8), sendpgppass(1), pgppipe(1)

AUTHOR
Richard Gooch (rgooch@atnf.csiro.au)

AVAILABILITY
The PGPsendmail/Unix Suite is available for anonymous ftp from: ftp.atnf.csiro.au:pub/people/rgooch ftp.dhp.com:pub/crypto/pgp/PGPsendmail ftp.ox.ac.uk:pub/crypto/pgp/utils linux.nrao.edu:pub/src/pgp/PGPsendmail