Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Many fetchmail tutorials I've read says putting your email account password clear-text in a config file is safe. However, I prefer security through layers [silly example: if my terminal is up and someone suspecting such email foolery slides over and simply types "grep -i pass ~/.*" then, oops, all my base are belong to them! especially if my email provider uses openid (or I'm dumb enough to use the same password for my bank)].

Now, with msmtp (as opposed to sendmail) I can authenticate using the OSX keychain. Is there a free/open-source email 'grabber' that lets me use Keychains (or at least, that lets me MD5 the password)?

share|improve this question
Security Rule of thumb: if someone has physical access to your machine, all your base belongs to them anyways. – gravyface Jun 11 '10 at 15:11
@gravy: I disagree - security through layers. Physical access isn't an all or none event (they can simply walk by my computer for a moment, or could steal it and have permanent control), moreover they'd have user access (and not root). – bias Jun 11 '10 at 15:38
@gravy: Seems like a misapplication of the rule of thumb if you use it to justify relaxed security. Why do people encrypt anything stored on their computer then? Why do password keychains exist? Do you use clear text passwords with .htaccess? – bias Jun 11 '10 at 15:49
cross-posted as… – Ether Mar 7 '15 at 22:15
up vote 1 down vote accepted

If retrieving mail via POP3 is sufficient for you, have a look at the excellent mpop. It's from the same author as msmtp and also has OSX keychain support for storing authentication credentials.

For IMAP4, you could use the very nice OfflineIMAP and connect it to an OSX keychain using William Snow Orvis' Python hook.

I personally prefer those tools over fetchmail (due to e.g. download speed, feature set, configuration), but your mileage may vary.

share|improve this answer

From a simple utility perspective, yes, you can use Keychain. I strongly encourage you to read the entire security(1) man page which has additional caveats.

You can enter the password using the Keychain program or via the command-line:

# WARNING: exposes password in ps(1), history(1), etc.
$ security add-internet-password -a $USER -s -w 'Mellon!'

You can extract this with:

# Note: by default, first use will prompt
$ security find-internet-password -s -a $USER -g

If you Always Allow, security(1) will be able to pull these credentials without further prompts. This may be a risk on your system. You could opt to have this always prompt for your password before launching, however.

Finally, using this, you can wrap your fetchmail call with a springboard script that sets the password to be used.

# WARNING: insecure tmpfile creation and usage
# As [DAM][1] mentions, see mkstemp(3)

password=$(security find-internet-password -s $server -a $USER -g 2>&1 \
           | perl -ne '/password: "(\S*)"/ and print $1')

# create temporary fetchmailrc and pass to fetchmail, etc...
cat <<EoF > $tmpfile
poll $server with proto POP3 and options no dns
  user $user with pass '$password' is $user here 
  options keep mda '/usr/bin/procmail -d %T'

fetchmail -d -f $tmpfile
rm -f $tmpfile

While this does achieve your stated goal of not having obvious files laying around with passwords, I did note the security risks still present with this configuration, which you should consider.

share|improve this answer
Carnegie Mellon? – arbales Jun 12 '10 at 22:42
Ah, sorry, no, Elvish. :) "Speak friend and enter", – medina Jun 12 '10 at 23:04

If the keychain allows the plaintext password to be lifted, then it is possible, but you can't MD5 passwords locally, as the server wants it in its own format (usually plaintext)

share|improve this answer

To use standard imap/smtp/pop3 you need a plaintext password. So if you want to store that locally it needs to be in a format which is reversible, which isn't great news for using the Keychain. However, if the mail server supports it then you can authenticate using an X.509 certificate and SSL. That certificate can be with or without password, and can be stored in the Mac OS X Keychain.

What I can't answer is whether any software actually supports this setup, since I'm not a Mac user. Plus you'd also need your server to support X509 authentication.

share|improve this answer


Instead of "tmpfile=/tmp/fetchmailrc.$$", I'd recommend using mktemp(1) if it's available.

share|improve this answer
Right you are, I omitted citing it so thanks for calling this out. Perl's File::Temp can provide a handy interface to access this kind of functionality. – medina Jun 12 '10 at 22:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.