Mastodawn

Julian Oliver Mar 6

Group-wide selfhosted mail is so often the solution here, but it needs to be done right, and with strong operational security posture. This includes the jurisdictional layer relative to operating context.

And yet #selfhosted mail is famously hard. We dedicate much time to this, deploying a full blown high-reputation MTA with webmail frontend, in the Fortress sessions https://courses.nikau.io/fortress/

#selfhosting

Fortress – Nīkau Courses

@JulianOliver how does disk encryption on servers work? Where do you store the secret?

@mihamarkic @JulianOliver use public key encryption, a server can encrypt all your non-encrypted incoming email with your public key, and only your client with your private key can decrypt it. Without your private key, nothing stored on the server can be decrypted.

This is pretty easy to implement yourself, using pgp, if you already run your own mail server.

@hyc @JulianOliver I was having disk encryption in mind, not the e-mail. Where even PGP is not a 100% solution.

@mihamarkic @JulianOliver ah. Yes, a good question, with, IMO, no good answers. On a laptop you can just prompt for a key or password on boot. On a server that must be able to reboot without human intervention, there is nowhere to store the key that's safe from snooping.

I've daydreamed about building a USB flash drive that only stays active for N seconds after a bus reset, then shuts itself off. Thus you could store a key on it that can be read at boot time, but not long after.

Miha Markič

@hyc @JulianOliver That's not a solution though - what would prevent the attacker to read from your USB drive? I thought of something else - what if server asked you for a password (you'd have an app i.e. on your phone) instead? That would help if you knew server was stolen but not if somebody broke in.

@mihamarkic @JulianOliver if they're not physically present then they can only attempt to read it during a short time window at bootup, when nothing but the kernel has started.

If they're physically present, all bets are off.

@mihamarkic @JulianOliver I suppose if only your home/data disk is encrypted, the machine could bring up enough networking to talk to an app on your phone. But still, if the attacker has physical access to the machine, they can sniff traffic or scan memory to grab the key.

@hyc @JulianOliver Agreed and that's what I said. So I were to suspect physical access or something, I wouldn't enter password.