Open Source Bridge - June 2016

BoF presentation of Project Oasis in Portland

Transcript

1. TAKE BACK YOUR EMAIL AND BRING IT HOME Project Oasis
2. • Background • What is Project Oasis • Why • How it works • Roadmap • Get involved
3. OUR BACKGROUND • Giri Sreenivas • Software dev + leadership @ Lockheed, Aplix, T-Mobile, Mobilisafe, Rapid7 • Startup vet - co-founder of Mobilisafe (acquired by Rapid7) • Dirk Sigurdson • Software dev + leadership @ N*Able, Wave, a la mobile, T-Mobile, Mobilisafe, Rapid7 • Startup vet - co-founder of Mobilisafe (acquired by Rapid7)
4. PROJECT OASIS OVERVIEW • Open source project that provides email, calendar and contacts services with single sign on that can be run from your house • https://github.com/privacylabs/oasis • You own the hardware, you own the data • Leverages a gateway running in the cloud for routing data and DNS • All encrypted communications terminate with the Pi - gateway can’t MiTM
6. WHY PROJECT OASIS EXISTS • People are living more of their lives online and are becoming increasingly dependent upon a handful of companies • These companies have built their businesses around exchanging free services for personal data, compromising privacy • People need a way to use core services like email in a way that respects their privacy • Data ownership is essential to privacy and protecting people from corporate and government surveillance
7. HOW THINGS WORK
8. CLOUD INVENTORY • Domain with name servers set to those from AWS Route53 Hosted Zone • AWS Account • Hosted Zone in Route53 for DNS • IAM User Account with AmazonEC2FullAccess and AmazonRoute53FullAccess IAM Policies
9. ROUTING • autossh - keeps a persistent secure tunnel between your server and the cloud gateway for inbound connections. • sshuttle - keeps a persistent secure tunnel between your server and the cloud gateway for outbound connections. Provides static IP facade for server • Maneuvers around ISP blocking of port 25 for email server sending/receiving
10. SOFTWARE INVENTORY • Raspberry Pi Server • OpenLDAP • Mailstack - Dovecot, Postfix, Rspamd, OpenDKIM, OpenDMARC, Sieve • Darwin Calendar and Contacts Server • Let’s Encrypt • sshuttle • autossh • Cloud gateway • ssh
11. IDENTITY • Leverages OpenLDAP for directory services • Single user account used to authenticate with mail, calendar, contacts and future services
12. EMAIL • Dovecot (IMAP) • Postfix (SMTP/Submission) • Rspamd (Anti-Spam) • OpenDKIM (DKIM) • OpenDMARC (DMARC) • Automatically creates DNS records to be a trusted email server
13. CALENDAR AND CONTACTS • Leverages Darwin Calendar and Contacts Server from Apple • Supports CardDAV and CalDAV
14. SECURITY • Leverages free, trusted certificates from the Let’s Encrypt project • All communications between your devices and the server are encrypted • Leverages fail2ban to reduce brute force attack threat
15. HARDWARE INVENTORY • Raspberry Pi 3 ($40) • 32GB Class 10 MicroSD Card with SD adapter ($12) • MicroUSB cable ($4) • USB power plug ($3) • Case ($8)
16. ROADMAP • email migration from your existing provider • TODOs • redundancy • availability • archiving • webmail • web UI for administration • update
17. GET INVOLVED • Project is up on GitHub • https://github.com/privacylabs/oasis • Try it out and give us feedback
18. THANKS! • Project Oasis - https://github.com/privacylabs/oasis • Giri Sreenivas - giri@privacylabs.io / @giri_sreenivas • Dirk Sigurdson - dirk@privacylabs.io / @dsigurds