{"id":100,"date":"2017-03-03T12:50:19","date_gmt":"2017-03-03T12:50:19","guid":{"rendered":"http:\/\/www.hestben.se\/HestbenTechnical\/?p=100"},"modified":"2017-03-03T12:50:19","modified_gmt":"2017-03-03T12:50:19","slug":"encrypting-automatic-mail-from-a-linux-server-with-gpg","status":"publish","type":"post","link":"https:\/\/www.hestben.se\/HestbenTechnical\/?p=100","title":{"rendered":"Encrypting automatic mail from a linux server with GPG"},"content":{"rendered":"

So, recently, I have been reviewing my systems, to harden them against attack. When I look back at it, I really think I have had quite naive in what security measures I employ.
\nOne thing I have started doing, is have logwatch send a mail to my mail address every day. That way, I am more forced to look into what is happening with the servers each day. This information could be interesting to an attacker, though, so it is important to secure that information. In part, I have been looking into if my MUA uses TLS to send the mail to the outgoing mail server (I will cover this in a different post). Then, you should ensure that connection is secure when downloading and viewing the mail is secure as well (also covered in a different post).
\nBut, in the end, you don’t know how the outgoing mail server sends the mail to the receiving server. Best is then to encrypt the mail. I did some duckduckgoing (the duckduckgo.com equivalent of googling) and found this post:GnuPG-encrypted mail forwarding<\/a><\/p>\n

Using the steps from that post, I first imported my public gpg-key for the root user with
\ngpg --import <path\/to\/public\/key><\/code>
\ngpg --edit-key <The key><\/code><\/code>
\nAnd trust the imported key ultimately (gpg will complain otherwise, and you don’t have any way to handle that interaction in an automated script). Thus, in the gpg-promt do:
\ntrust<\/code>
\n5<\/code>
\nAnd lastly, quit
\nquit<\/code><\/p>\n

Then, I created the mailgate user with
\nadduser mailgate<\/code><\/p>\n

On one of my systems, I use Maildir format instead of mbox-format, so I was changing my script to handle this. One con with the script in that<\/a> post above, is that the mail is not a Content-Type: multipart\/encrypted;<\/code>, instead, the body of the mail, is an encrypted text, that you manually need to decrypt with gpg.<\/p>\n

I asked around on the channels #gnupg<\/code> and #mutt<\/code> (you can use mutt<\/code> to send an encrypted mail, that has the correct format, but piping the message into mutt didn’t make it a Content-Type: multipart\/encrypted;<\/code> mail) on freenode, and was tipped by dtw<\/code> in #gnupg<\/code> about mime-construct (example usage<\/a>)<\/p>\n

So, I ended up with a script looking like this (beware that wordpress line breaks badly):<\/p>\n

#!\/bin\/bash
\n#backup this script to \/home\/robert\/scripts
\nrsync \/root\/scripts\/relay_mailgate_mail_encrypted \/home\/robert\/scripts\/
\nchown robert:robert \/home\/robert\/scripts\/relay_mailgate_mail_encrypted
\nMAILGATE_NEW_MAIL_DIR=\/home\/mailgate\/Maildir\/new
\nMAILGATE_CUR_MAIL_DIR=\/home\/mailgate\/Maildir\/cur
\nif [ ! -z \"$(ls -A $MAILGATE_NEW_MAIL_DIR)\" ]
\nthen
\nBACKUP_DIR=\/home\/mailgate\/mailbackup\/`date +%y%m%d-%H%M`
\nmkdir $BACKUP_DIR
\necho $BACKUP_DIR
\nrsync -a $MAILGATE_NEW_MAIL_DIR $BACKUP_DIR
\nfor mail in $MAILGATE_NEW_MAIL_DIR\/*
\ndo
\necho $mail
\ncat $mail | mime-construct --subpart \\
\n--type 'text\/plain; charset=UTF-8' \\
\n--encoding quoted-printable \\
\n--file - \\
\n| gpg --batch --yes \\
\n--armor --textmode --openpgp \\
\n--recipient \"mailaddr@domain.com\" \\
\n--encrypt \\
\n| mime-construct --output \\
\n--header \"From: root\" \\
\n--to \"mailaddr@domain.com\" \\
\n--subject \"Relayed mail\" \\
\n--header \"Date: $(date --rfc-2822)\" \\
\n--multipart 'multipart\/encrypted; protocol=\"application\/pgp-encrypted\"' \\
\n--type application\/pgp-encrypted \\
\n--encoding 7bit \\
\n--string $'Version: 1\\n' \\
\n--type application\/octet-stream \\
\n--file - | sendmail -i mailaddr@domain.com
\nmv $mail $MAILGATE_CUR_MAIL_DIR
\ndone
\nfi<\/code>
\nI called this script in a script in \/etc\/cron.hourly\/00mailencrypt<\/code>.
\nLastly, I edited the \/etc\/cron.daily\/00logwatch<\/code> and \/etc\/apt\/apt.conf.d\/50unattended-upgrades<\/code> scripts to mail to mailgate@localhost<\/code> instead of to an external address directly.<\/p>\n","protected":false},"excerpt":{"rendered":"

So, recently, I have been reviewing my systems, to harden them against attack. When I look back at it, I really think I have had quite naive in what security measures I employ. One thing I have started doing, is have logwatch send a mail to my mail address every day. That way, I am … Continue reading “Encrypting automatic mail from a linux server with GPG”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hestben.se\/HestbenTechnical\/index.php?rest_route=\/wp\/v2\/posts\/100"}],"collection":[{"href":"https:\/\/www.hestben.se\/HestbenTechnical\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hestben.se\/HestbenTechnical\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hestben.se\/HestbenTechnical\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hestben.se\/HestbenTechnical\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=100"}],"version-history":[{"count":9,"href":"https:\/\/www.hestben.se\/HestbenTechnical\/index.php?rest_route=\/wp\/v2\/posts\/100\/revisions"}],"predecessor-version":[{"id":109,"href":"https:\/\/www.hestben.se\/HestbenTechnical\/index.php?rest_route=\/wp\/v2\/posts\/100\/revisions\/109"}],"wp:attachment":[{"href":"https:\/\/www.hestben.se\/HestbenTechnical\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=100"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hestben.se\/HestbenTechnical\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=100"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hestben.se\/HestbenTechnical\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}