Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am wondering if it is possible to :

  1. Store a mailbox in a way that the system administrator (ie: root) cannot see it
  2. User(s) with the valid credentials would be able to see it AND be able to search quickly in it, preferably via http access

I know that I can:

  • Encrypt on the partition level, but it won't disallow the system administrator from seeing files in it.
  • Encrypt emails with the GPG system, but I don't if and how I could apply it to an entire mailbox (ie: past and future emails in this mailbox).
  • Give access to a mailbox via an open source webmail like roundcube, but I don't know if and how he would be able to access an encrypted mailbox

Do you know if this is possible?

share|improve this question
    
Have you considered encfs? I don't know if it is enough, especially for the http access. –  jmad May 22 '12 at 14:07
3  
If the system administrator has root access to the machine from which the mails are read, you are lost anyway, since root can see the memory of each process etc. On the mailing server, root can for example log incoming mails before they written to a "safe" place (if no end-point-to-end-point encryption with S/MIME or GPG is used). What you can consider, are RBAC system like SeLinux or grsecurity which allows to restrict the root user. Please think about the case if users forget their passwords/lost their credentials. –  jofel May 22 '12 at 14:59

3 Answers 3

up vote 2 down vote accepted

This is impossible: root can always access all data. Even if you encrypt it, as soon as you decrypt it for access, root can snoop on the data, and snoop on your credentials as well. You cannot protect anything from the local root.

You can store files on a machine whose administrator you don't rust, but you need to encrypt and sign them. This means that you'll only be able to search them on a machine that you trust. You can store the email and search indices on the untrusted machine, but the search must happen on a trusted machine. There is ongoing research on forms of encryption that could allow searching, but this is difficult (searchable and encrypted are fundamentally contradictory) — don't expect usable software anytime soon, if ever.

share|improve this answer
    
I think you're right. I'll choose a solution with tracability of root actions. –  Coren May 23 '12 at 10:50
    
@Coren Note that making root actions traceable is difficult, since root controls most logs. You need remote logs, or at least logs whose integrity is ensured by an external element such as tamper-resistant hardware such as a TPM. –  Gilles May 23 '12 at 18:33
    
I can make root actions traceable (relatively) easily with a ssh gateway between them, where user is not root at all. –  Coren May 24 '12 at 9:14
    
@Coren ssh gateway 'ssh root@host tar xzf -' is all it takes to irremediably break your reviewing ability. –  Gilles May 24 '12 at 14:36
    
I don't think that it's the case if the gateway is an appliance or a windows Box. –  Coren May 24 '12 at 17:01

I suppose in theory it should be possible to encrypt all incoming emails on the server with a public key from an e-mail user. Then this e-mail user can decrypt the e-mail with his private key when it retrieves the e-mail from the server on his local machine.

It is still not perfect, because incoming mail can still be intercepted at reception and of course you still have the e-mail stored probably at the actual sender's server. However, it is better than nothing in two ways. 1) If the root is not constantly monitoring all traffic, root will not be able to decrypt already received and stored messages. 2) It is contact friendly as you can use this on your own server without forcing your contacts to use pgp or encryption, as most people are probably not willing or able to. It would shield against most abuse of just peeking roots, offline and hot backups. Only not against active wiretapping (so not strictly government proof, but hardened non the less).

That's in theory however, I have no idea how to do this. If you encrypt the whole folder your email server is probably not able to give you individual messages. Would be nice if some server would allow to apply pgp on incoming messages instead of only outgoing messages. Workaround is rsyncing your encrypted folder and retrieve the actual mail from your local setup, or some other two-mail-server solution with one private mail server encrypting and sending (but no sending) to your private mail server.

share|improve this answer

I don't believe you can protect against root access when you are viewing the data yourself, but you can certainly keep root out when you are not using it.

The easiest way is probably ecryptfs. This comes as standard on Ubuntu, and probably others too.

There's two ways to set it up: 1. When you create a new user you have the option of encrypting the entire home directory. 2. Alternatively you can set it up to encrypt only the contents of your "Private" directory.

You can do number 2 pretty simply:

ecryptfs-setup-private

Normally the decryption password is the same as your login password: this means you only have to enter the password once and it will automatically mount the filesystem when you log in. Beware though: your password is stored one-way encrypted in the system passwd file; nobody can read it directly, but given time it can be cracked.

Ecryptfs does not store your password at all. Instead it used the password you enter as a cypher to decrypt a proper encryption key, so if you use an alternative password it's much more secure.

You can tell your email client to keep all your files in the secure directory and that should serve your purpose. Thunderbird makes this quite easy and also indexes your mail so you can search your mail efficiently, even if it is encrypted. I keep a very large mail folder this way with no obvious performance hit.

share|improve this answer
    
You can keep root out until you use it, but after that the game is over. Root can snoop on your encryption key. Encrypting the files is useful not to protect against local administrators, but against leaked backups. –  Gilles May 22 '12 at 23:32
    
I believe my first paragraph already said this .... –  ams May 23 '12 at 8:59
    
No: you claim that “you can certainly keep root out when you are not using it”, which is wrong. As soon as you've used the data once, root may have snatched your password and your data. –  Gilles May 23 '12 at 10:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.