meduzzza/blog-contributions
1
0
Fork 0
forked from nihilist/blog-contributions
Code Pull Requests Activity
main
blog-contributions/opsec/mailprivate/index.html
Zesc dcf265743e Fixed typos and broken link
2024-08-24 16:01:33 +02:00

943 lines
41 KiB
HTML
Raw Permalink Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="description" content="">
<meta name="author" content="">
<link rel="shortcut icon" href="../../../../../../assets/img/favicon.png">
<title>Anonymous self-hosted clearnet mail server Setup</title>
<!-- Bootstrap core CSS -->
<link href="../../assets/css/bootstrap.css" rel="stylesheet">
<link href="../../assets/css/xt256.css" rel="stylesheet">
<!-- Custom styles for this template -->
<link href="../../assets/css/main.css" rel="stylesheet">
<!-- HTML5 shim and Respond.js IE8 support of HTML5 elements and media queries -->
<!--[if lt IE 9]>
<script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
<script src="https://oss.maxcdn.com/libs/respond.js/1.3.0/respond.min.js"></script>
<![endif]-->
</head>
<body>
<!-- Static navbar -->
<div class="navbar navbar-inverse-anon navbar-static-top">
<div class="container">
<div class="navbar-header">
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
<span class="icon-bar"></span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
</button>
<a class="navbar-brand-anon" href="\index.html">nihilist`s Blog</a>
</div>
<div class="navbar-collapse collapse">
<ul class="nav navbar-nav navbar-right">
<li><a href="/about.html">About</a></li>
<li><a href="/blog.html">Categories</a></li>
<li><a href="https://blog.nowhere.moe/donate.html">Donate</a></li>
<li><a href="/contact.html">Contact</a></li>
</ul>
</div><!--/.nav-collapse -->
</div>
</div>
<!-- +++++ Posts Lists +++++ -->
<!-- +++++ First Post +++++ -->
<div id="anon2">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<a href="../index.html">Previous Page</a></br></br><p><img src="../../assets/img/user.png" width="50px" height="50px"> <ba>nihilist - 19 / 05 / 2022</ba></p>
<h1>Anonymous self-hosted clearnet mail server Setup </h1>
<img src="20.png" style="width:250px">
<p>In this tutorial we will setup a local mail server (to be able to keep control of our data), we will make it available publicly (so that it can communicate with other mail servers), but we'll make it go through TOR to guarantee Anonymity. </p>
<p>Note that this setup involves self-hosting, <a href="../sensitiveremotevshome/index.html">which I do not recommend if the service is supposed to be sensitive</a>. If this is an issue for you, just install it on a <a href="../anonymousremoteserver/index.html">non-KYC remote VPS</a> and skip the port-forwarding part if you don't want to host it at your house.</p>
<img src="0.png" class="imgRz">
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /grey -->
<!-- +++++ Second Post +++++ -->
<div id="anon3">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>Initial VPN over Tor Setup </b></h2>
<p>First let's make it use an external VPS as a VPN server (make sure that you get it from a <a href="https://kycnot.me/services?type=VPS">non-KYC cloud provider</a>, where you create your account with an email that you also registered through TOR.), see <a href="../ovpn_tor/index.html">this tutorial</a> i made for the full reasoning.</p>
<pre><code class="nim">
root@mail:~# apt update -y ; apt upgrade -y ; apt autoremove -y ; apt install vim tor obfs4proxy -y
</code></pre>
<p>Then we need to have the systemd services:</p>
<pre><code class="nim">
root@mail:~# vim /etc/systemd/system/tortables.service
root@mail:~# vim /etc/systemd/system/torwatch.service
root@mail:~# vim /etc/systemd/system/vpn.service
root@mail:~# vim /etc/systemd/system/sshtunnel.service
</code></pre>
<p>The tortables systemd service will run iptables to make sure our server only communicates locally:</p>
<pre><code class="nim">
root@mail:~# cat /etc/systemd/system/tortables.service
[Unit]
Description=Tor IP Tables
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
ExecStart=/root/iptables_vpn_tor.sh
[Install]
WantedBy=multi-user.target
root@mail:~# vim iptables_vpn_tor.sh
root@mail:~# cat iptables_vpn_tor.sh
#!/bin/bash
#default private networks
sudo iptables -F
sudo iptables -A INPUT -m iprange --src-range 192.168.0.0-192.168.255.255 -j ACCEPT
sudo iptables -A INPUT -m iprange --src-range 172.16.0.0-172.31.255.255 -j ACCEPT
sudo iptables -A INPUT -m iprange --src-range 10.0.0.0-10.255.255.255 -j ACCEPT
sudo iptables -A INPUT -m iprange --src-range 127.0.0.0-127.255.255.255 -j ACCEPT
sudo iptables -A OUTPUT -m iprange --dst-range 192.168.0.0-192.168.255.255 -j ACCEPT
sudo iptables -A OUTPUT -m iprange --dst-range 172.16.0.0-172.31.255.255 -j ACCEPT
sudo iptables -A OUTPUT -m iprange --dst-range 10.0.0.0-10.255.255.255 -j ACCEPT
sudo iptables -A OUTPUT -m iprange --dst-range 127.0.0.0-127.255.255.255 -j ACCEPT
#ip range of tor VPN:
sudo iptables -A OUTPUT -o tun0 -j ACCEPT
sudo iptables -A INPUT -i tun0 -j ACCEPT
sudo iptables -A INPUT -j DROP
sudo iptables -A OUTPUT -j DROP
</code></pre>
<p>The torwatch systemd service will make sure the tor connection is still up:</p>
<pre><code class="nim">
root@mail:~# cat /etc/systemd/system/torwatch.service
[Unit]
Description=torwatcher
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
ExecStart=/root/monitor_tor.sh
ExecStop=kill -9 $(pidof /root/monitor_tor.sh)
Restart=always
[Install]
WantedBy=multi-user.target
root@mail:~# vim monitor_tor.sh
root@mail:~# cat monitor_tor.sh
#!/bin/bash
counter=0
while true; do
echo TESTING
timeout 10 ping -c1 10.8.0.1 &>/dev/null
if [ $? -eq 0 ]; then
echo OK;
sleep 3
else
if [ $counter -gt 0 ];
then
echo 'RESTARTING TOR...'
systemctl restart tor@default
counter=0
sleep 10
else
counter=$((counter+1))
echo "FAIL ( $counter / 2)";
sleep 3
fi
fi
done
</code></pre>
<p>But as you can see it checks it by pinging 10.8.0.1, the OpenVPN server IP, meaning we need the vpn systemd service:</p>
<pre><code class="nim">
root@mail:~# cat /etc/systemd/system/vpn.service
[Unit]
Description=VPN
After=network-online.target
Wants=network-online.target
[Install]
WantedBy=multi-user.target
[Service]
Type=simple
ExecStart=/usr/sbin/openvpn /root/mail.ovpn
ExecStop=kill -9 $(pidof openvpn)
Restart=always
root@mail:~# apt install openvpn -y
</code></pre>
<p>Then we get the .ovpn file and modify it (if you want to see how to make a openvpn server, see it <a href="../ovpn/index.html">here</a>) the only requirement here is that you will need to setup the openvpn server to work on TCP, and not UDP as it is set by default. Why? because it will need to go through tor:</p>
<pre><code class="nim">
root@mail:~# vim mail.ovpn
root@mail:~# cat mail.ovpn
client
proto tcp-client
remote x.x.x.x 1194
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_6SQ8FnOk0eJa3n0F name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
### TOR SETTINGS ###
socks-proxy 127.0.0.1 9050
socks-proxy-retry
up-delay
route 10.0.0.195 255.255.255.255 net_gateway
###################
</code></pre>
<p>This will essentially force the openvpn connection to go through TOR, then we also edit our /etc/tor/torrc file, note that i intentionally route the traffic through a local bridge node, if you want to know how to set it up, please check <a href="../tor/bridge/index.html">this</a> tutorial:</p>
<pre><code class="nim">
root@mail-nihilism:~# cat /etc/tor/torrc
UseBridges 1
ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy
Bridge obfs4 10.0.1.195:8042 6E9324EC8317DE331DE1EA7969BD868136785748 cert=tyhAPcDxgIcuqcUXXxtkYVPKrWMH7bYf7RJcLa8d+oGbQjoYSK10g4Pz7a/dbJkMXLVvAA iat-mode=0
DataDirectory /var/lib/tor
TransPort 9040
SocksPort 9050
DNSPort 53
User debian-tor
root@mail:~# systemctl stop tor
root@mail:~# tor
May 15 12:00:17.068 [notice] Tor 0.3.5.16 running on Linux with Libevent 2.1.8-stable, OpenSSL 1.1.1n, Zlib 1.2.11, Liblzma 5.2.4, and Libzstd 1.3.8.
May 15 12:00:17.068 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
May 15 12:00:17.068 [notice] Read configuration file "/etc/tor/torrc".
May 15 12:00:17.076 [notice] Opening Socks listener on 127.0.0.1:9050
May 15 12:00:17.076 [notice] Opened Socks listener on 127.0.0.1:9050
May 15 12:00:17.076 [notice] Opening DNS listener on 127.0.0.1:53
May 15 12:00:17.076 [notice] Opened DNS listener on 127.0.0.1:53
May 15 12:00:17.076 [notice] Opening Transparent pf/netfilter listener on 127.0.0.1:9040
May 15 12:00:17.076 [notice] Opened Transparent pf/netfilter listener on 127.0.0.1:9040
May 15 12:00:17.000 [notice] Parsing GEOIP IPv4 file /usr/share/tor/geoip.
May 15 12:00:17.000 [notice] Parsing GEOIP IPv6 file /usr/share/tor/geoip6.
May 15 12:00:17.000 [notice] Bootstrapped 0%: Starting
May 15 12:00:18.000 [notice] Starting with guard context "bridges"
May 15 12:00:18.000 [notice] new bridge descriptor 'voidyt' (cached): $2E73653A148DFFF3CA28D53F0C366936FE554335~voidyt at 10.0.0.195
May 15 12:00:18.000 [notice] Delaying directory fetches: Pluggable transport proxies still configuring
May 15 12:00:19.000 [notice] Bootstrapped 5%: Connecting to directory server
May 15 12:00:19.000 [notice] Bootstrapped 10%: Finishing handshake with directory server
May 15 12:00:19.000 [notice] Bootstrapped 80%: Connecting to the Tor network
May 15 12:00:19.000 [notice] Bootstrapped 90%: Establishing a Tor circuit
May 15 12:00:19.000 [notice] Bootstrapped 100%: Done
root@mail-nihilism:~# systemctl restart tor@default.service
root@mail-nihilism:~# systemctl status tor@default.service
● tor@default.service - Anonymizing overlay network for TCP
Loaded: loaded (/lib/systemd/system/tor@default.service; enabled-runtime; vendor preset: enabled)
Active: active (running) since Thu 2022-12-08 12:14:21 CST; 29s ago
Process: 3515 ExecStartPre=/usr/bin/install -Z -m 02755 -o debian-tor -g debian-tor -d /run/tor (code=exited, status=0/SUCCESS)
Process: 3516 ExecStartPre=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0 --verify-config (code=exited, status=0/SUCCESS)
Main PID: 3517 (tor)
Tasks: 8 (limit: 4673)
Memory: 25.7M
CPU: 1.180s
CGroup: /system.slice/system-tor.slice/tor@default.service
├─3517 /usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0
└─3518 /usr/bin/obfs4proxy
Dec 08 12:14:22 mail-nihilism Tor[3517]: Bootstrapped 1% (conn_pt): Connecting to pluggable transport
Dec 08 12:14:23 mail-nihilism Tor[3517]: Opening Control listener on /run/tor/control
Dec 08 12:14:23 mail-nihilism Tor[3517]: Opened Control listener connection (ready) on /run/tor/control
Dec 08 12:14:23 mail-nihilism Tor[3517]: Bootstrapped 2% (conn_done_pt): Connected to pluggable transport
Dec 08 12:14:23 mail-nihilism Tor[3517]: Bootstrapped 10% (conn_done): Connected to a relay
Dec 08 12:14:23 mail-nihilism Tor[3517]: Bootstrapped 14% (handshake): Handshaking with a relay
Dec 08 12:14:23 mail-nihilism Tor[3517]: Bootstrapped 15% (handshake_done): Handshake with a relay done
Dec 08 12:14:23 mail-nihilism Tor[3517]: Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits
Dec 08 12:14:23 mail-nihilism Tor[3517]: Bootstrapped 95% (circuit_create): Establishing a Tor circuit
Dec 08 12:14:23 mail-nihilism Tor[3517]: Bootstrapped 100% (done): Done
</code></pre>
<p>Now that tor has been setup to use the local TOR relay, we apply iptable rules:</p>
<pre><code class="nim">
root@mail:~# ls
iptables_vpn_tor.sh mail.ovpn monitor_tor.sh
root@mail:~# chmod +x *.sh
root@mail:~# systemctl daemon-reload
root@mail-nihilism:~# systemctl enable --now tor@default.service tortables
Synchronizing state of tor.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable tor
Created symlink /etc/systemd/system/multi-user.target.wants/tortables.service → /etc/systemd/system/tortables.service.
root@mail:~# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere source IP range 192.168.0.0-192.168.255.255
ACCEPT all -- anywhere anywhere source IP range 172.16.0.0-172.31.255.255
ACCEPT all -- anywhere anywhere source IP range 10.0.0.0-10.255.255.255
ACCEPT all -- anywhere anywhere source IP range 127.0.0.0-127.255.255.255
ACCEPT all -- anywhere anywhere
DROP all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere destination IP range 192.168.0.0-192.168.255.255
ACCEPT all -- anywhere anywhere destination IP range 172.16.0.0-172.31.255.255
ACCEPT all -- anywhere anywhere destination IP range 10.0.0.0-10.255.255.255
ACCEPT all -- anywhere anywhere destination IP range 127.0.0.0-127.255.255.255
ACCEPT all -- anywhere anywhere
DROP all -- anywhere anywhere
</code></pre>
<p>And from there we can connect to the VPN server:</p>
<pre><code class="nim">
root@mail:~# systemctl enable --now vpn torwatch
Created symlink /etc/systemd/system/multi-user.target.wants/torwatch.service → /etc/systemd/system/torwatch.service.
root@mail:~# systemctl status vpn torwatch
root@mail:~# systemctl status vpn torwatch
● vpn.service - VPN
Loaded: loaded (/etc/systemd/system/vpn.service; static; vendor preset: enabled)
Active: active (running) since Sun 2022-05-15 12:03:26 CEST; 18s ago
Main PID: 3144 (openvpn)
Tasks: 1 (limit: 2359)
Memory: 1.5M
CGroup: /system.slice/vpn.service
└─3144 /usr/sbin/openvpn /root/mail.ovpn
May 15 12:03:28 mail openvpn[3144]: Sun May 15 12:03:28 2022 ROUTE_GATEWAY 10.0.0.1/255.255.0.0 IFACE=ens18 HWADDR=ee:b5:c9:3a:c3:fe
May 15 12:03:28 mail openvpn[3144]: Sun May 15 12:03:28 2022 TUN/TAP device tun0 opened
May 15 12:03:28 mail openvpn[3144]: Sun May 15 12:03:28 2022 TUN/TAP TX queue length set to 100
May 15 12:03:28 mail openvpn[3144]: Sun May 15 12:03:28 2022 /sbin/ip link set dev tun0 up mtu 1500
May 15 12:03:28 mail openvpn[3144]: Sun May 15 12:03:28 2022 /sbin/ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255
May 15 12:03:28 mail openvpn[3144]: Sun May 15 12:03:28 2022 /sbin/ip route add 127.0.0.1/32 via 10.0.0.1
May 15 12:03:28 mail openvpn[3144]: Sun May 15 12:03:28 2022 /sbin/ip route add 0.0.0.0/1 via 10.8.0.1
May 15 12:03:28 mail openvpn[3144]: Sun May 15 12:03:28 2022 /sbin/ip route add 128.0.0.0/1 via 10.8.0.1
May 15 12:03:28 mail openvpn[3144]: Sun May 15 12:03:28 2022 /sbin/ip route add 10.0.0.195/32 dev ens18
May 15 12:03:28 mail openvpn[3144]: Sun May 15 12:03:28 2022 Initialization Sequence Completed
● torwatch.service - torwatcher
Loaded: loaded (/etc/systemd/system/torwatch.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2022-05-15 12:03:26 CEST; 18s ago
Main PID: 3145 (monitor_tor.sh)
Tasks: 2 (limit: 2359)
Memory: 1.1M
CGroup: /system.slice/torwatch.service
├─3145 /bin/bash /root/monitor_tor.sh
└─3172 sleep 3
May 15 12:03:26 mail systemd[1]: Started torwatcher.
May 15 12:03:26 mail monitor_tor.sh[3145]: TESTING
May 15 12:03:36 mail monitor_tor.sh[3145]: FAIL ( 1 / 2)
May 15 12:03:39 mail monitor_tor.sh[3145]: TESTING
May 15 12:03:39 mail monitor_tor.sh[3145]: OK
May 15 12:03:42 mail monitor_tor.sh[3145]: TESTING
May 15 12:03:42 mail monitor_tor.sh[3145]: OK
</code></pre>
<p>And now our mail server uses the remote server as a VPN server, but only through TOR, meaning even if the VPS provider were to check the server logs, or the networking traffic, he would see that it all came from tor exit nodes, never from public ips.</p>
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<div id="anon2">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>Mail Server Setup</b></h2> </br> </br>
<p>Then we setup the mail itself on the local mail VM which is now connected to the VPN:</p>
<pre><code class="nim">
root@mail:~# apt update -y ; apt upgrade -y ; apt install vim tmux curl certbot python3-certbot-nginx nginx -y
</code></pre>
<p>Then we make sure that the ports are forwarded through the vpn connection:</p>
<pre><code class="">
#on the VPN server we forward the ports to the local VM via iptables:
root@mail-gw:~# cat iptables_forwardrules.sh
#!/bin/bash
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 23.137.250.140 --dport 25 -j DNAT --to-destination 10.8.0.2:25
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 23.137.250.140 --dport 80 -j DNAT --to-destination 10.8.0.2:80
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 23.137.250.140 --dport 443 -j DNAT --to-destination 10.8.0.2:443
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 23.137.250.140 --dport 143 -j DNAT --to-destination 10.8.0.2:143
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 23.137.250.140 --dport 465 -j DNAT --to-destination 10.8.0.2:465
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 23.137.250.140 --dport 587 -j DNAT --to-destination 10.8.0.2:587
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 23.137.250.140 --dport 993 -j DNAT --to-destination 10.8.0.2:993
root@mail:~# chmod +x iptables_forwardrules.sh
root@mail:~# ./iptables_forwardrules.sh
#from the VM we allow the packets to be forwarded to us:
root@mail-nihilism:~# cat iptables_forwardrules.sh
#!/bin/bash
iptables -A FORWARD -p tcp -d 10.8.0.2 --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.8.0.2 --dport 143 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.8.0.2 --dport 465 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.8.0.2 --dport 587 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.8.0.2 --dport 993 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.8.0.2 --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.8.0.2 --dport 80 -j ACCEPT
root@mail-nihilism:~# chmod +x iptables_forwardrules.sh
root@mail-nihilism:~# ./iptables_forwardrules.sh
</pre></code>
<p>Dont forget to allow ip forwarding on the vpn server:</p>
<pre><code class="">
root@mail-gw:~# sysctl net.ipv4.conf.ens3.forwarding=1
net.ipv4.conf.ens3.forwarding = 1
root@mail-gw:~# sysctl net.ipv6.conf.ens3.forwarding=1
net.ipv6.conf.ens3.forwarding = 1
root@mail-gw:~# echo " net.ipv6.conf.ens3.forwarding=1" >>/etc/sysctl.conf
root@mail-gw:~# echo " net.ipv4.conf.ens3.forwarding=1" >>/etc/sysctl.conf
root@mail-gw:~# sysctl -p
net.ipv6.conf.ens3.forwarding = 1
net.ipv4.conf.ens3.forwarding = 1
#for arch users, install libvirt:
sudo pacman -S libvirt
vim /etc/sysctl.d/30-ipforward.conf
cat /etc/sysctl.d/30-ipforward.conf
net.ipv4.ip_forward=1
net.ipv6.conf.default.forwarding=1
net.ipv6.conf.all.forwarding=1
[ nihilism ] [ /dev/pts/1 ] [~]
→ sysctl net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1
</pre></code>
<p>Then you make sure that your DNS records are set properly:</p>
<img src="3.png" class="imgRz">
<p>example of the record on a <a href="../dns/index.html">bind9</a> server:</p>
<pre><code class="nim">
root@mail-gw:~# cat /var/cache/bind/db.nowhere.moe
mail.nowhere.moe. IN A 23.137.250.140
</pre></code>
<p>Then wait for it to propagate:</p>
<pre><code class="nim">
root@mail-nihilism:~# curl ifconfig.me
23.137.250.140root@mail-nihilism:~#
root@mail-nihilism:~# curl ifconfig.me ; echo
23.137.250.140
root@mail-nihilism:~# ping mail.nowhere.moe
PING mail.nowhere.moe (23.137.250.140) 56(84) bytes of data.
64 bytes from 23.137.250.140 (23.137.250.140): icmp_seq=1 ttl=64 time=160 ms
--- mail.nowhere.moe ping statistics ---
2 packets transmitted, 1 received, 50% packet loss, time 1001ms
rtt min/avg/max/mdev = 160.031/160.031/160.031/0.000 ms
root@mail-nihilism:~# ping nowhere.moe
PING nowhere.moe (23.137.250.141) 56(84) bytes of data.
64 bytes from 23.137.250.141 (23.137.250.141): icmp_seq=1 ttl=63 time=204 ms
</code></pre>
<p>Once that's done we prepare nginx on the local VM still:</p>
<pre><code class="nim">
root@mail-nihilism:~# rm /etc/nginx/sites-*/default
root@mail-nihilism:~# cat /etc/nginx/sites-available/mail.nowhere.moe.conf
server {
listen 80;
listen [::]:80;
root /var/www/mail;
index index.html;
server_name mail.nowhere.moe;
location / {
try_files $uri $uri/ =404;
}
}
root@mail-nihilism:~# ln -s /etc/nginx/sites-available/mail.nowhere.moe.conf /etc/nginx/sites-enabled/
root@mail-nihilism:~# systemctl restart nginx
root@mail-nihilism:~# systemctl status nginx
● nginx.service - A high performance web server and a reverse proxy server
Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2022-12-08 13:18:14 CST; 19s ago
Docs: man:nginx(8)
Process: 5903 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
Process: 5904 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
Main PID: 5905 (nginx)
Tasks: 3 (limit: 4673)
Memory: 3.2M
CPU: 49ms
CGroup: /system.slice/nginx.service
├─5905 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
├─5906 nginx: worker process
└─5907 nginx: worker process
Dec 08 13:18:14 mail-nihilism systemd[1]: Starting A high performance web server and a reverse proxy server...
Dec 08 13:18:14 mail-nihilism systemd[1]: Started A high performance web server and a reverse proxy server.
root@mail-nihilism:~# mkdir -p /var/www/mail/
root@mail-nihilism:~# echo 'nowhere.moe' > /var/www/mail/index.html
root@mail-nihilism:~# curl 127.0.0.1
nowhere.moe
root@mail-nihilism:~# ip a | grep inet
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
inet 10.0.0.203/16 brd 10.0.255.255 scope global dynamic ens18
inet6 fe80::e4e7:41ff:fe70:e9a6/64 scope link
inet 10.8.0.2/24 scope global tun0
inet6 fe80::18b1:efc9:1ae0:d93f/64 scope link stable-privacy
#from the vpn server:
root@mail-gw:~# curl 10.8.0.2
nowhere.moe
</code></pre>
<p>Now that's done we use certbot to get certificate from the local mail server:</p>
<pre><code class="nim">
root@mail-nihilism:~# certbot --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Enter email address (used for urgent renewal and security notices)
(Enter 'c' to cancel): nihilist@nowhere.moe
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: mail.nowhere.moe
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
Requesting a certificate for mail.nowhere.moe
Performing the following challenges:
http-01 challenge for mail.nowhere.moe
Waiting for verification...
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/mail.nowhere.moe.conf
Redirecting all traffic on port 80 to ssl in /etc/nginx/sites-enabled/mail.nowhere.moe.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https://mail.nowhere.moe
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/mail.nowhere.moe/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/mail.nowhere.moe/privkey.pem
Your certificate will expire on 2023-03-08. To obtain a new or
tweaked version of this certificate in the future, simply run
certbot again with the "certonly" option. To non-interactively
renew *all* of your certificates, run "certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
root@mail-nihilism:~# cat /etc/nginx/sites-available/mail.nowhere.moe.conf
server {
root /var/www/mail;
index index.html;
server_name mail.nowhere.moe;
location / {
try_files $uri $uri/ =404;
}
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/mail.nowhere.moe/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/mail.nowhere.moe/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = mail.nowhere.moe) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
listen [::]:80;
server_name mail.nowhere.moe;
return 404; # managed by Certbot
</code></pre>
<p>And that's it! Now we can proceed with creating the mail server locally:</p>
<pre><code class="nim">
root@mail-nihilism:~# wget https://raw.githubusercontent.com/LukeSmithxyz/emailwiz/master/emailwiz.sh -O emailwiz.sh
--2022-12-08 13:27:42-- https://raw.githubusercontent.com/LukeSmithxyz/emailwiz/master/emailwiz.sh
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.109.133, 185.199.110.133, 185.199.111.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.109.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 13320 (13K) [text/plain]
Saving to: ‘emailwiz.sh’
emailwiz.sh 100%[==========================================================================================================================================>] 13.01K --.-KB/s in 0.06s
2022-12-08 13:27:44 (225 KB/s) - ‘emailwiz.sh’ saved [13320/13320]
root@mail-nihilism:~# chmod +x emailwiz.sh
root@mail-nihilism:~# sh emailwiz.sh
</code></pre>
<img src="4.png" class="imgRz">
<p>(putting the TLD instead of mail.nowhere.moe here is intentional)</p>
<img src="5.png" class="imgRz">
<p>if it complains with the error "Please point your domain (nowhere.moe) to your server's ipv4 address, do the following:</p>
<pre><code class="nim">
#add it into your /etc/hosts
vim /etc/hosts
cat /etc/hosts | grep nowhere.moe
23.137.250.140 nowhere.moe
#add it into your DNS zone too (ex in bind9 below):
</pre></code>
<img src="6.png" class="imgRz">
<p>Then we change edit the DNS records as described above:</p>
<img src="7.png" class="imgRz">
<img src="8.png" class="imgRz">
<img src="9.png" class="imgRz">
<p>Here's how you can set it up on a bind9 DNS server:</p>
<pre><code class="nim">
$TTL 604800
@ IN SOA ns1.nowhere.moe. nihilist.nowhere.moe. (
33 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
; name servers - NS records
3600 IN NS ns1.nowhere.moe.
3600 IN NS ns2.nowhere.moe.
3600 IN A 23.137.250.141
3600 IN AAAA fe80::216:3eff:fe6c:c335
; mail-gw services
@ IN MX 0 mail.nowhere.moe.
nowhere.moe. IN TXT "v=spf1 mx a:mail.nowhere.moe -all"
mail.nowhere.moe. IN A 23.137.250.140
mail._domainkey.nowhere.moe. IN TXT (
"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu94n6zyhzWLZZrgvRq5HrSAh29TRi"
"jw6AXzFoJeahRPoAnJ3njOfOgbCzxUsVNO1L2+NX2P5iZMkdiVtB7rE71wUutegAb0wCDY5k5RNLUlAThxdlou0ro37H"
"SWK5GRAcEFKm1iab63uTtAXtIvZDPLYMxZMIUq4osxYEgAXY4BCzFBCyfohvr+eGd/kPbfOC9f7jrBnFiOVllnB+yPQKe"
"XwPeVlPrw68muFiVg4vWfMMzayINQgC12d73hKVZIwD8T6V9Kznv0dPi929CDWns2alU2dZypVSHxWm3BZyb4SCobdrFNW"
"xfzb1dz7n6/ms5u0EVAKU9ufGOgS4A70oQIDAQAB")
_dmarc.nowhere.moe. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@nowhere.moe; fo=1"
[...]
</pre></code>
<p>Please note that on average the DNS records need 1-2 days to propagate fully throughout the world. So be patient once you've made the changes. Also note the DKIM record is on multiple lines, that's because there is a length limit that bind9 has for some reason, so above is how i managed to get around that restriction.</p>
<p>Then we add our first user:</p>
<pre><code class="nim">
root@mail-nihilism:~# useradd -G mail -m nihilist
useradd: user 'nihilist' already exists
root@mail-nihilism:~# id nihilist
uid=1000(nihilist) gid=1000(nihilist) groups=1000(nihilist),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev)
root@mail-nihilism:~# passwd nihilist
New password:
Retype new password:
passwd: password updated successfully
root@mail:~# apt install nmap -y
root@mail-nihilism:~# nmap 127.0.0.1
Starting Nmap 7.80 ( https://nmap.org ) at 2022-12-08 13:49 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000026s latency).
Not shown: 989 closed ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
80/tcp open http
143/tcp open imap
443/tcp open https
465/tcp open smtps
587/tcp open submission
783/tcp open spamassassin
993/tcp open imaps
9040/tcp open tor-trans
9050/tcp open tor-socks
Nmap done: 1 IP address (1 host up) scanned in 0.27 seconds
root@mail-nihilism:~# nmap 10.0.0.202
Starting Nmap 7.80 ( https://nmap.org ) at 2022-12-08 13:49 CST
Nmap scan report for 10.0.0.202
Host is up (0.000097s latency).
Not shown: 992 closed ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
80/tcp open http
143/tcp open imap
443/tcp open https
465/tcp open smtps
587/tcp open submission
993/tcp open imaps
MAC Address: EE:B5:C9:3A:C3:FE (Unknown)
</code></pre>
<p>The ports we need are ready to be used locally, so let's login:</p>
<pre><code class="nim">
[ 10.66.66.2/32 ] [ /dev/pts/38 ] [~]
→ sudo pacman -S thunderbird
[ 10.66.66.2/32 ] [ /dev/pts/38 ] [~]
→ thunderbird
</code></pre>
<p>Then test it on thunderbird:</p>
<img src="17.png" class="imgRz">
<img src="18.png" class="imgRz">
<p>And that's it! We managed to connect! now we test if the mail works:</p>
<img src="19.png" class="imgRz">
<p>(You probably guessed it, i accessed protonmail via tor to make sure i don't leak any personal info) And sending a mail to the VPS gets properly routed through the openvpn connection which is being sent through tor.</p>
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<!-- +++++ Second Post +++++ -->
<div id="anon1">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>Miscellaneous</b></h2> </br> </br>
<p>If you want to use PGP encryption, you can manually do it in your terminal, please see this <a href="../pgp/index.html">tutorial</a> to know how to do it.</p>
<p>However there's a way to do it in thunderbird:</p>
<img src="31.png" class="imgRz">
<p>If you don't have one, you can click create a new OpenPGP key, but i have one so i'll just import it:</p>
<pre><code class="nim">
[ 10.8.0.3/24 ] [ nowhere ] [~]
→ gpg --output ~/.nihilist.privkey --export-secret-keys nihilist@nowhere.moe
</pre></code>
<img src="32.png" class="imgRz">
<img src="33.png" class="imgRz">
<img src="34.png" class="imgRz">
<p>So from here you can copy your public key and paste it wherever you want, for example on your website, so that the users who want to message you will be able to encrypt their messages. Also add the following settings in thunderbird to automatically encrypt messages you wish to send out:</p>
<img src="35.png" class="imgRz">
<p>Now let's test it:</p>
<img src="36.png" class="imgRz">
<p>As you can see, by default you don't have the destination's PGP key, so for this first mail we won't encrypt it and see how it looks like on the receiver's end:</p>
<img src="37.png" class="imgRz">
<img src="38.png" class="imgRz">
<p>Now we see that the receiver got the unencrypted message, with our PGP signature as an attachment. The recipient can now save it, and use it to encrypt his messages with us.</p>
<pre><code class="nim">
[ 10.8.0.3/24 ] [ nowhere ] [~]
→ gpg --gen-key
gpg (GnuPG) 2.2.40; Copyright (C) 2022 g10 Code GmbH
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Note: Use "gpg --full-generate-key" for a full featured key generation dialog.
GnuPG needs to construct a user ID to identify your key.
Real name: nothing
Email address: nothing@void.yt
You selected this USER-ID:
"nothing <<b></b>nothing@void.yt>"
Change (N)ame, (E)mail, or (O)kay/(Q)uit? O
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: revocation certificate stored as '/home/nothing/.gnupg/openpgp-revocs.d/95FC37D748FA891A9C33B821CF39FCDC8049F9FE.rev'
public and secret key created and signed.
pub rsa3072 2022-12-10 [SC] [expires: 2024-12-09]
95FC37D748FA891A9C33B821CF39FCDC8049F9FE
uid nothing <<b></b>nothing@void.yt>
sub rsa3072 2022-12-10 [E] [expires: 2024-12-09]
[ 10.8.0.3/24 ] [ nowhere ] [~]
→ gpg --output ~/.nothing.privkey --export-secret-keys nothing@void.yt
</pre></code>
<p>Now the user nothing can use his PGP key and import it into thunderbird aswell:</p>
<img src="39.png" class="imgRz">
<img src="40.png" class="imgRz">
<img src="41.png" class="imgRz">
<p>Same as before, now the user nothing also has E2E encryption setup, so let's now send a reply to nihilist but this time encrypted:</p>
<img src="42.png" class="imgRz">
<p>And that's it! We managed to setup a mail service, whose origin is unknown from the cloud provider's perspective, and who's able to send and recieve E2EE mails to prevent any unauthorized third-party from seeing the mails content.</p>
<!--<pre><code class="nim">
[ torVPS ] [ /dev/pts/1 ] [~]
→ cat mailforwardrules.sh
#!/bin/bash
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 104.167.217.88 --dport 25 -j DNAT --to-destination 10.8.0.3:25
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 104.167.217.88 --dport 143 -j DNAT --to-destination 10.8.0.3:143
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 104.167.217.88 --dport 465 -j DNAT --to-destination 10.8.0.3:465
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 104.167.217.88 --dport 587 -j DNAT --to-destination 10.8.0.3:587
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 104.167.217.88 --dport 993 -j DNAT --to-destination 10.8.0.3:993
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 104.167.217.88 --dport 443 -j DNAT --to-destination 10.8.0.3:443
iptables -A PREROUTING -t nat -i ens3 -p tcp -d 104.167.217.88 --dport 80 -j DNAT --to-destination 10.8.0.3:80
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ens3 -j MASQUERADE #dont forget this line if you can't ping past the vpn server
root@mail:~# cat iptables_forwardrules.sh
#!/bin/bash
iptables -A FORWARD -p tcp -d 10.8.0.3 --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.8.0.3 --dport 143 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.8.0.3 --dport 465 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.8.0.3 --dport 587 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.8.0.3 --dport 993 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.8.0.3 --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.8.0.3 --dport 80 -j ACCEPT
</code></pre>
<p>The SSL certificates are there:</p>
<pre><code class="nim">
root@mail:/etc/letsencrypt/live/mail.nowhere.moe# ls -lash
total 12K
4.0K drwxr-xr-x 2 root root 4.0K Dec 4 18:17 .
4.0K drwx------ 3 root root 4.0K Dec 4 18:17 ..
0 lrwxrwxrwx 1 root root 45 Dec 4 18:17 cert.pem -> ../../archive/mail.nowhere.moe/cert1.pem
0 lrwxrwxrwx 1 root root 46 Dec 4 18:17 chain.pem -> ../../archive/mail.nowhere.moe/chain1.pem
0 lrwxrwxrwx 1 root root 50 Dec 4 18:17 fullchain.pem -> ../../archive/mail.nowhere.moe/fullchain1.pem
0 lrwxrwxrwx 1 root root 48 Dec 4 18:17 privkey.pem -> ../../archive/mail.nowhere.moe/privkey1.pem
4.0K -rw-r--r-- 1 root root 692 Dec 4 18:17 README
</code></pre>
<p>They can be renewed with certbot:</p>
<pre><code class="nim">
certbot --nginx
certbot --nginx --force-renew
</code></pre>
<p>And you need to make sure the correct ssl configs certificate paths are used:</p>
<pre><code class="nim">
root@mail:~# vim /etc/dovecot/conf.d/10-ssl.conf
root@mail:~# cat /etc/dovecot/conf.d/10-ssl.conf | grep ssl_key
#ssl_key = <<b></b>/etc/dovecot/private/dovecot.key
ssl_key = <<b></b>/etc/letsencrypt/live/mail.nowhere.moe/privkey.pem
# root owned 0600 file by using ssl_key_password = <<b></b>path.
#ssl_key_password =
root@mail:~# cat /etc/dovecot/conf.d/10-ssl.conf | grep ssl_cert
#ssl_cert = <<b></b>/etc/dovecot/private/dovecot.pem
ssl_cert = <<b></b>/etc/letsencrypt/live/mail.nowhere.moe/fullchain.pem
#ssl_cert_username_field = commonName
</code></pre>-->
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<!-- +++++ Footer Section +++++ -->
<div id="anonb">
<div class="container">
<div class="row">
<div class="col-lg-4">
<h4>Nihilism</h4>
<p>
Until there is Nothing left.
</p>
</div><!-- /col-lg-4 -->
<div class="col-lg-4">
<h4>My Links</h4>
<p>
<a target="_blank" rel="noopener noreferrer" href="http://blog.nowhere.moe/rss/feed.xml">RSS Feed</a><br/><a target="_blank" rel="noopener noreferrer" href="https://matrix.to/#/#nowheremoe:nowhere.moe">Matrix Chat</a><br/>
</p>
</div><!-- /col-lg-4 -->
<div class="col-lg-4">
<h4>About nihilist</h4>
<p style="word-wrap: break-word;"><u>Donate XMR:</u> 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8</p></br><p><u>Contact:</u> nihilist@nowhere.moe (<a href="https://nowhere.moe/nihilist.pubkey">PGP</a>)</p>
</div><!-- /col-lg-4 -->
</div>
</div>
</div>
<!-- Bootstrap core JavaScript
================================================== -->
<!-- Placed at the end of the document so the pages load faster -->
</body>
</html>
View Git Blame Copy Permalink