ToorCon 2016 - Privacy Workshop - Take Back Your Email

Transcript

1. PRIVACY WORKSHOP Take Back Your Email and Bring It Home Project Oasis
3. PRIVACY WORKSHOP WIFI • SSID=privacyworkshop • password=comfy84#gibe
4. AGENDA • Oasis Overview • Review inventories - cloud, software, hardware • Prepare local environment • Deploy • Explain the software stack and architecture
5. PROJECT OASIS OVERVIEW • Open source project that provides email, calendar and contacts services with single sign on that can be run from your house • https://github.com/privacylabs/oasis • You own the hardware, you own the data • Leverages a gateway running in the cloud for routing data and DNS • All encrypted communications terminate with the Pi - gateway can’t MiTM
6. CLOUD INVENTORY • Domain with name servers set to those from AWS Route53 Hosted Zone • AWS Account • Hosted Zone in Route53 for DNS • IAM User Account with AmazonEC2FullAccess and AmazonRoute53FullAccess IAM Policies
7. SOFTWARE INVENTORY • Raspberry Pi Server • OpenLDAP • Mailstack - Dovecot, Postfix, Rspamd, OpenDKIM, OpenDMARC, Sieve • Darwin Calendar and Contacts Server • Let’s Encrypt • sshuttle • autossh • Cloud gateway • ssh
8. HARDWARE INVENTORY • Raspberry Pi 3 ($40) • 32GB Class 10 MicroSD Card with SD adapter ($12) • MicroUSB cable ($4) • USB power plug ($3) • Case ($8)
9. LET’S GET STARTED • Windows Users • Install a decent ssh client like putty • Linux Users • Install avahi-daemon • Mac Users • Chill
10. QUICKSTART • Open a browser and visit https://github.com/ privacylabs/oasis • Scroll down to the QuickStart section and get started • After you log in, change your password • We have already completed the “Preparing the Pi” section for you with the image on the microSD card
11. DEPLOY • Deploy Oasis ansible-playbook -i inventory site.yml
13. IDENTITY • Leverages OpenLDAP for directory services • Single user account used to authenticate with mail, calendar, contacts and future services
14. EMAIL • Dovecot (IMAP) • Postfix (SMTP/Submission) • Rspamd (Anti-Spam) • OpenDKIM (DKIM) • OpenDMARC (DMARC) • Automatically creates DNS records to be a trusted email server
15. CALENDAR AND CONTACTS • Leverages Darwin Calendar and Contacts Server from Apple • Supports CardDAV and CalDAV
16. SECURITY • Leverages free, trusted certificates from the Let’s Encrypt project • All communications between your devices and the server are encrypted • Leverages fail2ban to reduce brute force attack threat
17. ROUTING • autossh - keeps a persistent secure tunnel between your server and the cloud gateway for inbound connections. • sshuttle - keeps a persistent secure tunnel between your server and the cloud gateway for outbound connections. Provides static IP facade for server • Maneuvers around ISP blocking of port 25 for email server sending/receiving
18. CONFIGURE CLIENTS • username is user in user@domain.com • password is what you set in your ansible vault • server is mail.yourdomain.com • Ports • IMAP - 993 • SMTP (Submission) - 587 • CalDAV And CardDAV - 8443
19. FINAL STEPS • Configure your Pi for your home WiFi network • See Step 8 under Preparing Your Pi in the README • Remove local repository from /etc/apt/sources.list • delete deb http://192.168.1.144/raspbian/mirror/raspbian/ jessie main contrib non-free rpi • Make sure you remember/store your 3 passwords • Vault • email user • Pi user account
20. FOLLOW UP • email migration from your existing provider • TODOs • redundancy • availability • archiving • webmail • web UI for administration • update
21. THANKS! • Project Oasis - https://github.com/privacylabs/oasis • Giri Sreenivas - giri@privacylabs.io / @giri_sreenivas • Dirk Sigurdson - dirk@privacylabs.io / @dsigurds
22. BACKUP
23. SET UP YOUR DOMAIN • Visit https://aws.amazon.com and create an account (1 year of free tier services) • Go to the AWS Management console and click on Route53 • Register your domain (e.g. girisreenivas.com)
24. CREATE AWS ACCESS KEYS • Under “Security and Identity”, click Identity and Access Management (IAM) • Click Users • Click New Users • Enter user name • Download and save credentials • Select user from list • Click Permissions, Attach Policy and add ‘AdministratorAccess’ policy