Get Off The Free Teat of Gmail, Hotmail and Yahoo by Setting Up Your Own Linux Email Server Using iRedMail

In this final episode of Tech Chop, I talked about how I decided to give up my free Google Apps email account and setup my own email server on an Ubuntu Linux VPS using iRedMail.

As you can see in the video, iRedMail is probably the easiest email server you will ever setup. You basically stand up a plain Ubuntu server with no other applications, then you run the install script from iRedmail which installs just about everything you need.

I am personally doing this to avoid the NSA's PRISM program, as well as to stop giving Google unfettered access to my private email information that they can then turn over to the feds, or sell to marketers.

Related articles

• Email Servers - Gateway to Secure Communication
• Canonical cracks the slate code, brings Ubuntu to Nexus tablets
• Monitor Your Public Facing Servers For Free With UptimeRobot
• How To poll out lotus notes(or any other mail server) emails into a Ruby App

Read more »

Android Users: Get The NSA Out Of Your Text Messages With TextSecure

Last week I wrote about a really great app for your Android or iPhone that allows you to encrypt phone conversations so the NSA and the other federal alphabet soup guys can't snoop on your conversations. That app was called RedPhone.

Well the makers of RedPhone, WhisperSystems, have another app for Android that does something similar for text messages. It's called TextSecure!

From their Google Play Page:

Like privacy? Secure your SMS/MMS communication with TextSecure. It's that simple. 

TextSecure encrypts your text messages over the air and on your phone. It's almost identical to the normal text messaging application, and is just as easy to use.
TextSecure Provides:

• A secure and private replacement for the default text messaging app.

• All messages are encrypted locally, so if your phone is lost or stolen, your messages will be safe.

• Messages to other TextSecure users are encrypted over the air, protecting your communication in transit.

• TextSecure is Free and Open Source, enabling anyone to verify its security by auditing the code.

TextSecure is the only Android private SMS/MMS messenger replacement that uses open source peer-reviewed cryptographic protocols to keep your messages safe. Rather than simply pretending to hide your texts by putting them in another place, TextSecure uses cryptography to ensure that they remain truly secure.

Up until now I have been using Google Voice for everything, especially since they have Sprint integration. Well, I ended that last week and switched over to TextSecure. Now Google, who has given backdoor access to the NSA through PRISM, doesn't have unfettered access to my text message archive. At the very least, now Google can't sell information found in my text messages to marketers.

If I'm texting others with TextSecure, my messages are stored encrypted, and sent encrypted so the NSA can't snoop the content of our conversation.

If I am texting those who don't value their rights, sure the NSA can snoop that off the wire, but at least me messages are stored using encryption on my phone. I guess you can't win them all.

So far this app is only available on Android. If you know of another application that has an iPhone counterpart, or one that is compatible with TextSecure, let me know in the comments.

Related articles

• Ask a hacker: Top four anti-surveillance apps
• Burn after reading: Privatext messaging app allows secure texts, pictures to self-destruct
• Burn after reading: Privatext messaging app allows secure texts, pictures to self-destruct
• Privatext Launches New Application to Provide Consumers and Businesses with Secure Messaging Platform; Text Messages Automatically Delete off Devices and Servers after Designated Time

Read more »

Configure Postfix and Dovecot SSL Settings For PCI Compliance

Yes, this is yet another post on my Linux email server that I am using to get off of Google's teat, and of course avoid the NSA's PRISM program.

As a part of setting up my email server I wanted to lock it down well enough that it would pass a Payment Card Industry (PCI) security scan from a PCI authorized auditor like Comodo's Hacker Guardian. My reasoning is that if I can pass a scan that banks and credit card companies use to evaluate their security against hackers, that it's probably the best one can do against the NSA.

I am very familiar with locking down regular websites. After all, it's a part of what I do for my day job. I've even written about how to configure SSL on Apache for PCI compliance, as well as Windows 2008R2 and Windows 2003.

Will with my email server, I also had to configure SSL encryption for SMTP and IMAP using Postfix and Dovecot respectively. It took a while because I didn't see a lot of documentation online on how to do it, but I finally figured it out.

For Postfix (/etc/postfix/main.cf), use these settings for SSL/TLS:

smtpd_tls_cert_file = /etc/path/to/public.crt
smtpd_tls_key_file = /etc/path/to/private.key
smtpd_tls_CAfile = /etc/path/to/ca-bundle.pem
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_protocols = SSLv3, TLSv1
smtpd_tls_ciphers = medium
smtpd_tls_exclude_ciphers = aNULL, 3DES, MD5, AES
smtpd_sasl_security_options = noplaintext

For Dovecot (/etc/dovecot/dovecot.conf) use these settings for SSL/TLS:

ssl = required
verbose_ssl = no
ssl_cert = </etc/path/to/public.crt
ssl_key = </etc/path/to/private.key
ssl_ca = </etc/path/to/ca-bundle.crt
ssl_cipher_list = HIGH:+TLSv1:+SSLv3:!LOW:!SSLv2:!EXP:!aNULL

That's it! After I made those settings I was able to pass my PCI scan from Hacker Guardian:

That's not the only thing you have to worry about of course. You have to do stuff like hide your PHP version, and Apache version as well, but the SSL stuff is usually the hardest to deal with in PCI.

Did this help you out? If so, let us know in the comments.

Related articles

• Securing Postfix
• Compile postfix with TLS And SASL for Sendgrid.
• Talk:Simple Virtual User Mail System
• PCI Scan Fail SSL Certificates ClearOS/CentOS

Read more »

NSA Proof Your Cellular Phone Calls With RedPhone

 (Photo credit: HarrisonEarl)

A lot of what I've been blogging about lately has been to do with covering your ass from illegal government snooping. One of the big bombshells that broke recently was that the Department of Justice has issued warrants to all of the major phone companies to obtain all phone records for everyone in the United States.

Also, it has been reported on some news sites that the NSA is actively grabbing those phone conversations out of the air as well. So what is one to do about it?

Well, last year I talked about setting up your own secure VoIP server, but if you don't want to go through that sort of headache, and you are an Android or an iPhone user there is another solution. You can use RedPhone.

From their Google Play Page:

Like privacy? Secure your calls for free with RedPhone. It's that simple.
RedPhone provides end-to-end encryption for your calls, securing your conversations so that nobody can listen in.

•  RedPhone uses your normal phone number to make and receive calls, so you don't need yet another identifier.

• Use the default system dialer and contacts apps to make calls as you normally would.

• RedPhone will give you the opportunity to upgrade to encrypted calls whenever the person you're calling also has RedPhone installed.

• RedPhone calls are encrypted end-to-end, but function just like you're used to.

• Free and Open Source, enabling anyone to verify its security by auditing the code.

• Uses wifi or data, not your plan's voice minutes.

For Android, the app is free, but iPhone users have to pay $0.99 for theirs. Still though, not a high price to pay for your privacy.

Related articles

• The SINGLE Most Important Step to Protect Yourself from Government Spying
• Ask a hacker: Top four anti-surveillance apps
• Personal Security Concerns Rise Tenfold in the Wake of NSA Data Mining Scandal
• Does encryption really shield you from government's prying eyes?

Read more »

Are Your Running Microsoft Windows? The NSA Has Backdoor Access

 (Photo credit: Wikipedia)

In a chilling, yet somehow unsurprising report I read on Monday it turns out that no matter how well you think you've locked down your Windows workstation or server, the NSA can still easily get into it. Why? Because Microsoft has been building backdoor's into their operating system since Windows 95.

From WND:

The National Security Agency has backdoor access to all Windows software since the release of Windows 95, according to informed sources, a development which follows the insistence by the agency and federal law enforcement for backdoor “keys” to any encryption, according to a report in Joseph Farah’s G2 Bulletin. 

Having such “keys” is essential for the export of any encryption allowed under U.S. export control laws to foreign users. 

...Computer security specialists say that the Windows software driver used for security and encryption functions contains unusual features which give NSA that backdoor access. 

These security specialists have identified the driver as ADVAPI.DLL. It enables and controls a variety of security functions. These specialists say that on Windows, it is located at C:\Windows\system directory of anyone’s computer that uses Windows software. 

Nicko van Someren says the driver contains two different keys. One was used by Microsoft to control cryptographic functions in Windows while another initially remained a mystery. 

Then, two weeks ago, a U.S. security firm concluded that the second key belonged to NSA. Analysis of the driver revealed that one was labeled KEY while the other was labeled NSAKEY, according to sources. The NSA key apparently had been built into the software by Microsoft, which Microsoft sources don’t deny.

Also it is now known that with the PRISM system that Google and Apple have also given the NSA access to your "free" email. It is probably a safe bet that if you are using a computer running Apple's OSX, or Google's Chrome OS, that the NSA has a backdoor into those as well.

I recommend switching over to Bauer-Puntu Linux. It's open source, and built on Xubuntu. If you can read code, you can download the source for Xubuntu yourself to see if there's a backdoor. It also comes pre-installed with different encryption and privacy options to keep the NSA off your back.

Related articles

• Microsoft app syncs Windows 8, Windows Phone 8
• NSA has total access via Microsoft Windows
• Chilling Discovery -- NSA HAS TOTAL ACCESS VIA MICROSOFT WINDOWS: 'They can effectively compromise your entire operating system'...
• NSA has total access via Microsoft Windows

Read more »

Encrypt Your Linux Tarball Backups

(Photo credit: Wikipedia)

Again with my anti-NSA server... This time I had to figure out how to back it up. Now Linode.com, where I am hosting it, does have a backup solution for an extra $100 per month... Um, no thanks.

Normally for a Linux server I run a script to compress certain directories into a tarball, then I download them later to my backup server to write to tape. Since all my emails on my new email server are stored in an encrypted volume, I wanted to make sure that the files that were stored in the encrypted volume could be backed up in an encrypted tarball that I could download later. That way if someone were to seize my server, the encrypted volume wouldn't be mounted and the backup files would be encrypted as well.

Well there is a handy utility that you can pipe tar into that will do just that, and it's called ccrypt. To install it on Ubuntu just run:

sudo apt-get install ccrypt

Now to automate the encryption you need to store you encryption passphrase in a text file. I stored mine in a hidden file called .passkey which is kept in my encrypted volume. That way if the server is rebooted, the .passkey file is safe. For this article, let's say that passkey is stored in /var/encrypted.

The command you would run to backup the /var/backup folder would be:

tar -czvf - /var/backup/ | ccrypt -k /var/encrypted/.passkey > backup.tgz.cpt

You can also add a date stamp to your encrypted tarball by appending `date '+%d-%B-%Y'` to the file name. In that case your command would look something like this:

tar -czvf - /var/backup/ | ccrypt -k /var/encrypted/.passkey > backup-`date '+%d-%B-%Y'`.tgz.cpt

Now if you ever need to restore your backup, just run the following to decrypt the file:

ccrypt -d backup.tgz.cpt

It will prompt you for the passphrase, then it will output the decrypted tarball to backup.tgz. After that, you can untar like usual.

Now you just need to copy those files off to a safe location, and you have a backup that is still safe from the feds, and hackers.

Related articles

• How to install .tar.gz and other tarball files in Linux
• Create secure remote backups using Duplicity - Tutorial
• Encrypt The Sensitive Files On Your Linux VPS Using Truecrypt
• NSA: If Your Data Is Encrypted, You Might Be Evil, So We'll Keep It Until We're Sure

Read more »

Monitor Your Public Facing Servers For Free With UptimeRobot

Still on the kick of talking about my new anti-NSA email server, I wanted to tell you about monitoring it. I found a public service that lets me keep an eye on my email server 24/7 in five minute intervals all for free.

It's called UptimeRobot. I used to use Monitor.us, but their free service only checks if your server is up every 30 minutes. A server could easily be rebooted during that time and you would never know. With UptimeRobot, it checks on whatever service you want every five minutes.

Plus it can notify you in several ways including Email, SMS, RSS or Twitter. That is particularly handy if the thing you are monitoring is an email server like me, and you need an alternative way to be notified.

The free version allows you to monitor up to 50 sites or services. You can monitor they with HTTP/HTTPS, Ping or specifying a TCP port. You can also supply login credentials if the service you are checking requires a login.

What do you use to monitor your websites or public servers? Is it free? Let us know what you use in the comments.

Related articles

• Uptime.ly
• Monitor Website Uptime
• The Essentials Of Website Monitoring
• Web Site Migration Guide - Tips For SEOs

Read more »