10:00 AM
El DiPablo
 |
| (Photo credit: Wikipedia) |
I like many people got upset when they heard the news about the NSA's PRISM program. It's one of the reasons I added a number of encryption programs to Bauer-Puntu Linux. One of the things that I've thought about doing for a while though was to move my email off of Google Apps.
Sure, I knew that the NSA had been sucking up everything on the Internet since I found out about their Stellar Wind program, but I was rather shocked to learn about PRISM, and how the NSA basically has direct access to the big name email providers like Google, Yahoo and Microsoft. Even if they didn't though there are at least two other inherent privacy concerns with using a third party email provider.
For one, they have full access to your email and often sell your personal information to marketers. When you are using a free service like Gmail, you are not the customer... You are the product being sold.
More scary than that though is that if the government wants access to your email on a third party email provider, they don't need a warrant. All they need to do is serve the provider with a National Security Letter, and they don't have to notify you, and the email provider is legally gagged from telling you. Nice right?
Because I'm using a VPS, there is also a risk that the government could demand access to my server from the VPS provider without telling me. That's where the gist of this post comes in!
So because I am using a VPS, I was not able to do the install of Ubuntu myself and encrypt the entire server. I had to take the template they gave me. So I opened a ticket with support and asked them a few questions:
- Does Linode have root access, or a backdoor account to my VPS?
- Does Linode have the ability to reset the root password on my VPS?
Their answers were no and yes respectively. However if they need to reset the root password, they have to shutdown the VPS, and go into recovery mode. So encryption that doesn't automatically mount at boot up would work to protect my information from being taken by the feds without a warrant (and a decryption password is protected by the 5th Amendment).
Like I said though, the VPS templates don't use encryption, so you have to set it up yourself, and I found a way... Using Truecrypt for Linux!
Since everything is done in a terminal on a Linux server, you have to get savvy with the terminal commands of Truecrypt. For instance, you can create a Truecrypt volume by running the following:
truecrypt -c secret.tc
That will create an encrypted volume file called secret.tc.
On my server, the email store is located in /var/vmail, so what I did was backed up all the files and folders in there, removed them, then I used Truecrypt to mount my encrypted volume to /var/vmail by running:
truecrypt --mount /secret/secret.tc /var/vmail
I then copied the files back to /var/vmail and reset permissions.
I put the mounting command into a little script that I can manually run after a reboot so I have to manually put in my decryption password and key file information, then the script restarts my email services and my email server is ready to go!
Now if for some reason the feds order Linode to shutdown my VPS, reset the root password and give them access they won't be able to access my email because it's not mounted automatically. Now they have to come see me with a warrant. Once again, encryption keys are protected by the 5th Amendment!
Small price to pay to make sure the government doesn't violate my rights I think.
Sure, Ubuntu has the ability to encrypt folders, but once the feds have root access after a password reset they can decrypt the folders easily. With Truecrypt it is a little harder to break in my opinion. If they want to access my email without a warrant or notification now, they will have to try and bruteforce my Truecrypt volume.
Can they do it? With government supercomputers? Probably. I, however won't make it easy for them. Besides, according to NSA whistleblower Edward Snowden, encryption is effective in protecting your information from government snooping as long as you have good endpoint security.
What do you think about this? Overkill? Are you going to do something similar? Sound off in the comments.
