Tag: Security

Using Self-Signed S/MIME Certificates in Thunderbird

This guide describes the process for using self-signed S/MIME certificates with Mozilla Thunderbird on Windows 10. If you need an S/MIME certificate, please follow the guide to Create Self-Signed S/MIME Certificates. Certificates allow you to both send digitally signed messages and receive encrypted messages as part of public-key cryptography (also known as asymmetric cryptography). By creating and self-signing your own certificates, you avoid paying recurring fees but you lose the inherent trust that comes with a certificate generated by a well-known certificate company. After having written similar guides for iOS / iPadOS and Outlook, in my opinion, Thunderbird is probably the easiest to establish trust and set up your own certificates.

Part 1 – Trusting Self-Signed S/MIME Personal Certificates

Step 1 – Account Settings

From the Thunderbird menu (the hamburger icon button or collapsed menu icon button), select Account Settings.

Step 2 – End-To-End Encryption

The Account Settings screen is displayed. Select End-To-End Encryption from the account settings menu. Click the Manage S/MIME Certificates button.

Account Settings – End-To-End Encryption

Step 3 – Establish Personal Certificate Trust

The Certificate Manager window is displayed. From the available tabs, select Your Certificates followed by the Import… button. The Certificate File to Import window is displayed. Find the .p12 file containing the appropriate self-signed certificate for this e-mail account and click the Open button.

The Password Required prompt is displayed. Enter the password set when the .p12 package was created and then click the Sign in button.

The personal certificate is now displayed in the Your Certificates tab of the Certificate Manager.

Certificate Manager – Personal Certificates

Step 4 – Establish Certificate Authority Trust

Now the certificate authority certificate needs to be added to the Certificate Manager so that the personal certificate can be trusted. Select the Authorities tab and click the Import… button.

The Select File containing CA certificate(s) to import window is displayed. Find the .crt file containing the appropriate certificate authority certificate used to create the personal certificate and click the Open button. If the guide Create Self-Signed S/MIME Certificates was followed, then the file is named ca.crt.

The Downloading Certificate prompt is displayed. Confirm the displayed information and CA certificate are correct. The Trust this CA to identify email users checkbox should be checked. Click the OK button when complete.

Downloading Certificate – Authority Certificate

The certificate authority certificate is now displayed in the Certificate Manager window on the Authorities tab. In this example, the certificate authority certificate was established using the Organization Name as TEST COMPANY and the Common Name as TEST COMPANY CERTIFICATE AUTHORITY. Click the OK button to close the Certificate Manager window.

Step 5 – S/MIME Settings for Digital Signing and Encryption

Now that trust has been established for the certificate authority certificate as well as the personal certificate, the S/MIME section of the End-To-End Encryption settings screen can be completed.

Account Settings – End-To-End Encryption (Completed)

In the Personal certificate for digital signing field, click the Select… button next to the field. The Select Certificate prompt is displayed. Select the appropriate certificate from the drop-down list and confirm the displayed details. Click the OK button.

A prompt may be displayed asking “You should also specify a certificate for other people to use when they send you encrypted messages. Do you want to configure an encryption certificate now?” Click the Yes button. The Personal certificate for encryption field is populated with the same certificate specified for the digital signature.

If the question prompt was not displayed, Thunderbird returns to the End-To-End Encryption settings screen. If the Personal certificate for encryption is not populated in the S/MIME section, then click the Select… button next to the Personal certificate for encryption field. The Select Certificate prompt is displayed. Select the appropriate certificate from the drop-down list and confirm the displayed details. Click the OK button. I can’t think of a reason why the digital signature and encryption fields would use different certificates, but I’m sure someone has an edge case where the distinction is needed. Generally, I would expect both fields to reference the same personal certificate.

Close the Account Settings screen.

Part 2 – Sending a Digitally Signed and Encrypted Message

At this point, trust has been established for both the certificate authority certificate and the personal certificate. The personal certificate has been established for use in digital signatures as well as encryption and Thunderbird is ready to send a digitally signed message.

Step 1 – Draft New Message

Click the Write button to draft a new message. A new message window opens.

Step 2 – Set Security Options

In the Options menu for the message, select Digitally Sign This Message.

I was also able to select Require Encryption because the sender and recipient are the same e-mail address in this example (I sent an e-mail to myself). Since the sender and recipient are the same, Thunderbird already has a trusted recipient certificate. If Require Encryption is selected and a recipient certificate isn’t available, then Thunderbird displays the error “Sending of the message failed. You specified encryption for this message, but the application failed to find an encryption certificate for <e-mail address>.”

The Digitally Sign This Message and Require Encryption options may also be set by clicking the Security button. View Security Info will display the recipient certificate, if available.

Step 3 – Send Message

Complete drafting the message and click the Send button. A Message Security prompt is displayed. Confirm the displayed information is correct and click the OK button to send the message.

Result

The recipient receives a digitally signed message using the sender’s self-signed certificate. In this example, since the sender and recipient are the same, the recipient also received an encrypted message.

Using Self-Signed S/MIME Certificates in Outlook

If you followed my guide to create self-signed S/MIME certificates, then you will have the necessary files to begin digitally signing and receiving encrypted e-mail. As long as the e-mail client supports S/MIME, which Outlook does support, then you can create and use your own certificates for any e-mail address including custom domains, Gmail, iCloud, or even AOL. This guide describes the process for using self-signed S/MIME certificates with Microsoft Outlook 2019 found in the Microsoft Office Professional Plus 2019 suite running on Windows 10.

Part 1 – Trusting the Self-Signed Certificate Authority

Since we’re using self-signed certificates, Windows and Outlook will not automatically recognize your personal certificate authority. If a certificate authority is not trusted, then any certificates issued by that certificate authority are not trusted and they are considered invalid by Outlook. If you try to send a digitally signed e-mail using your personal certificate before the certificate authority is trusted, then Outlook displays the message “Microsoft Outlook cannot sign or encrypt this message because your certificate is not valid.”

Step 1 – Install Certificate

Find the certificate authority certificate. If you followed my guide, the file is named ca.crt. Double-click on the file in File Explorer to open it. The Certificate Information screen is displayed. Confirm that the Issue to, Issued by, and Valid from/to dates match the expected values.

Click the Install Certificate… button.

Install Self-Signed Certificate Authority Certificate

Step 2 – Select Store Location

The Certificate Import Wizard screen is displayed. Choose Current User and click the Next button.

Certificate Import Wizard – Store Location

Step 3 – Select Certificate Store

The Certificate Store screen is displayed. Select Place all certificates in the following store and click the Browse… button.

Certificate Import Wizard – Store Selection

The Select Certificate Store screen is displayed. Select Trusted Root Certification Authorities and click the OK button.

Certificate Import Wizard – Trusted Root Certification Authorities

Confirm the details on the Select Certificate Store screen and click the Next button.

Step 4 – Complete the Certificate Import Wizard

The Completing the Certificate Import Wizard screen is displayed. Confirm the displayed details and click the Finish button.

Step 5 – Security Warning

A Security Warning screen is displayed requesting confirmation that the certificate should be installed. Confirm the displayed details and click the Yes button.

The Import Successful dialog box is displayed.

Close the Certificate Information screen by clicking the OK button.

Step 6 – Confirm Trusted Certification Authorities in CertMgr

From the Windows start menu, run certmgr (Manager user certificates). Under Current User, expand Trusted Root Certification Authorities and click Certificates. Review the list of certificates to confirm your certificate authority is in the store. Close the application.

CertMgr – Trusted Root Certification Authorities

Part 2 – Installing the Self-Signed S/MIME Certificate in Outlook

With the certificate authority certificate in the Windows trust store, we can now add our self-signed S/MIME certificate to Outlook.

Step 1 – Open Trust Center

Open Outlook and select File and then Options. The Outlook Options screen is displayed. Select Trust Center.

Step 2 – Open Email Security

Click the Trust Center Settings… button. The Trust Center screen is displayed. Select Email Security.

Step 3 – Import Self-Signed S/MIME Certificate

Click the Import/Export… button. The Import/Export Digital ID screen is displayed. In the Import existing Digital ID from a file section, click the Browse… button. Find the relevant PKCS12 file. If you followed my guide, the file is named smime_test_user.p12. Enter the password for the package.

Click the OK button.

Step 4 – Import Certificate

The Importing a new private exchange key dialog box is displayed. Click the OK button.

Step 5 – Change Security Settings

Returning to the Trust Center screen, click the Settings… button. The Change Security Settings screen is displayed. Confirm the displayed information is correct. Change the Security Settings Name value to a unique name for the certificate.

If the Signing Certificate or Encryption Certificate are blank, then click either Choose… button. The Windows Security Confirm Certificate dialog box is displayed. Click the OK button.

Confirm the information on the Change Security Settings dialog box are correct and click the OK button.

Step 6 – Confirm Default Settings

On the Trust Center Email Security settings screen, confirm the Default Setting references the security settings name created in the prior step. Click the OK button to close the Trust Center screen. On the Outlook Options screen, click the OK button to close the screen.

Trust Center – Email Security Settings Completed

Part 3 – Sending a Digitally Signed E-mail

Finally, we can send a digitally signed e-mail in Outlook using a self-signed S/MIME certificate issued by a personal certificate authority. As a reminder, this does not allow you to send encrypted e-mails since public-key cryptography requires the sender to have the public key for the recipient (we only have the sender keys). However, this does allow you to send a digitally signed e-mail to a recipient. Since the digital signature contains your public key, the recipient can than respond with an encrypted e-mail after establishing trust in their e-mail client.

Step 1 – Draft and Sign E-mail

Create a new e-mail using the e-mail address associated with the S/MIME certificate. From the Options ribbon, click Sign.

Step 2 – Send E-mail

Complete the e-mail and click the Send button. A Windows Security dialog box is displayed requesting access to the private key. Click the Allow button.

Result

When the e-mail is received, the recipient’s e-mail client displays an indicator that the e-mail is digitally signed. Outlook’s indicator for digitally signed e-mail is a small ribbon. The recipient may then need to trust the certificate (public key) contained in your digital signature in order to respond with an encrypted message.

If you send a digitally signed e-mail from the e-mail address back to itself, you can respond to that e-mail with an encrypted message. Open the e-mail and click Reply. From the Options ribbon, click Encrypt. Add a response to the message body and click the Send button. When the response is received, Outlook displays a lock icon to indicate that the e-mail is encrypted. Outlook automatically handles the decryption when the e-mail is opened.

Part 4 – Establishing Recipient Trust

When a recipient receives a digitally signed e-mail where the sender used a self-signed S/MIME certificate and a personal certificate authority, the message is flagged by Outlook with the message “There are problems with the signature. Click the signature button for details.” The signature button is the yellow triangle with an exclamation point. As the sender, we added trust in Part 1 of this guide to the sending machine, however, the recipient machine does not recognize the certificate authority so the digital signature certificate is not trusted and flagged as invalid.

Outlook – Digital Signature is Invalid Warning

Step 1 – Invalid Digital Signature

Click the yellow triangle with an exclamation point icon. The Digital Signature: Invalid dialog box is displayed.

Step 2 – Message Security Properties (Invalid)

Click the Details… button. The Message Security Properties screen is displayed. There are many intimidating red circles with exclamation points.

Outlook – Message Security Properties (Invalid)

Step 3 – Trust Certificate Authority

If available, click the Trust Certificate Authority… button. The Trust Certificate Authority screen is displayed. Click the Trust button. The Trust Certificate Authority screen closes. If the button is not active, proceed to the next step.

Step 4 – View Certificate and Edit Trust

Returning to the Message Security Properties screen, click the Edit Trust… button. The View Certificate screen is displayed. In the Edit Trust section, select Explicitly Trust this Certificate. Click the OK button.

Step 5 – Message Security Properties (Valid)

Returning to the Message Security Properties screen again, we find all the red circles have been replaced with green check marks. Click the Close button.

Outlook – Message Security Properties (Valid)

Step 6 – Valid and Trusted Digital Signature

The Digital Signature: Invalid dialog box is now the Digital Signature: Valid dialog box. Click the Close button. The digital signature is now trusted and flagged as valid.

Bash Script to Automatically Backup Amazon Lightsail WordPress Server to Google Drive

The intent of this Bash script is to backup the WordPress installation directory, the MySQL database, and a handful of Apache/PHP/MySQL configuration files to Google Drive on a regular basis in an encrypted archive. While this script references paths/files specific to a Bitnami based Amazon Lightsail instance, it can be easily modified to any other Linux based environment. I fully understand that AWS has an automatic snapshot/backup capability, but I want to use Google Drive and I don’t want to incur any additional costs since AWS snapshots are not free.

Usage

If no options are specified when executing this script it will backup all MySQL databases accessible to the user specified in the .mysqldump.cnf file. No other files will be included in the backup. All files are packaged in a tar.gz file and encrypted using AES-256.

-f (full backup) includes both the MySQL dump as well as other files specified in the script.
-e is used to encrypt the backup archive. If this flag is set, then a password must be supplied in the .backup.cnf file.
-n x sets the number of files to retain on Google Drive in the upload directory (x is an integer value). The default is 30 files.
-d sets the parent folder where the backup file is uploaded on Google Drive. If the folder doesn’t exist, then the script will create it. The default folder name is “backup”.
-p sets the filename prefix of the backup file. The script will use the prefix followed by the date/time to set the full filename. The default filename prefix is “backup”.
-m is used to specify the database name to backup. The default is all databases.

Examples

This example uses all of the available options and will create a full encrypted backup of both MySQL and other files. The backup file is named backup-example-com (with a date/time suffix) and uploaded it to a folder named backup-full-example-com on Google Drive. If the specified folder contains more than 5 files, the script deletes any files beyond the 5 based on a filename sort.

./backup.sh -e -f -n 5 -d backup-full-example-com -p backup-example-com -m db_example_com_wp_prd

Installation

As a personal preference, I store user scripts and associated configuration files in a subdirectory under home named “scripts”.

The following command creates the “scripts” subdirectory.

mkdir -m 700 ~/scripts

Next, create a file named .mysqldump.cnf. This file will be used by the mysqldump command in the backup script to pass the MySQL database user and password to dump the WordPress database.

touch ~/scripts/.mysqldump.cnf
chmod 600 ~/scripts/.mysqldump.cnf
vim ~/scripts/.mysqldump.cnf

In the vim editor, add the database username and password with access to dump all of the required tables and data for a backup. Apostrophes surrounding the password are needed if any special characters are used in the actual password.

[mysqldump]
user=username
password='password'

The following commands create the .backup.cnf file which contains a secret key used by the script to encrypt the backup file.

touch ~/scripts/.backup.cnf
chmod 600 ~/scripts/.backup.cnf
vim ~/scripts/.backup.cnf

In the vim editor, add a secret key/password to the file.

pass=passsword

Now we’ll create the actual backup script. Please be sure to modify any referenced paths and constants to your own environment.

touch ~/scripts/backup.sh
chmod 700 ~/scripts/backup.sh
vim ~/scripts/backup.sh

Source Code

The following is the full Bash script. Please modify any constants/paths for your own environment and requirements.

#!/bin/bash

getConfigVal() {
  echo `grep ${1} "${2}" | cut -d '=' -f 2`
}

dirname_temp_backup="automated_backup"
filename_prefix_backup="backup"
filename_suffix_backup="_$(date +'%Y_%m_%d_%H_%M')"
db_name="--all-databases"
gdrive_backup_dirname="backup"
num_files_to_retain=30
path_script="$(dirname "$(readlink -f "$0")")"
path_mysqldump="$(which mysqldump)"
path_gdrive="$(which drive)"
path_backup_cnf="${path_script}/.backup.cnf"
path_mysqldump_cnf="${path_script}/.mysqldump.cnf"
path_backup="${HOME}/${dirname_temp_backup}"

if [ -z "${path_script}" ] || [ -z "${path_mysqldump}" ] || [ -z "${path_gdrive}" ] || [ -z "${path_backup_cnf}" ] || [ -z "${path_mysqldump_cnf}" ] || [ -z "${path_backup}" ]
then
  echo "ERROR: One or more required path variable(s) are undefined or missing."
  exit 1
fi

while getopts efn:d:p:m: flag
do
  case "${flag}" in
    e)
      bool_encrypt_backup=1
      encryption_key=$(getConfigVal "pass" "${path_backup_cnf}")

      if [ -z "${encryption_key}" ]
      then
        echo "ERROR: Encryption key not found."
        exit 1
      fi
      ;;
    f)
      bool_full_backup=1
      ;;
    n)
      if ! [[ "${OPTARG}" =~ ^[0-9]+$ ]]
      then
        echo "WARNING: Number of backups to retain must be an integer. Reverting to default value (${num_files_to_retain})."
      else
        num_files_to_retain="${OPTARG}"
      fi
      ;;
    d)
      gdrive_backup_dirname="${OPTARG}"
      ;;
    p)
      filename_prefix_backup="${OPTARG}"
      ;;
    m)
      db_name="--databases ${OPTARG}"
      ;;
  esac
done

num_files_to_retain=$((num_files_to_retain+1))

sudo rm -rf "${path_backup}"
sudo rm "${HOME}/${filename_prefix_backup}"*.tar.gz

mkdir "${path_backup}"

if [ -n "${bool_full_backup}" ]
then
  find /www -type d -not -path '*/cache/*' -exec mkdir -p "${path_backup}"/{} \;
  find /www -type f -not -path '*/cache/*' -exec sudo cp '{}' "${path_backup}"/{} \;
  cp /opt/bitnami/apache2/conf/vhosts/example-com-https-vhost.conf "${path_backup}"
  cp /opt/bitnami/apache2/conf/vhosts/example-com-vhost.conf "${path_backup}"
  cp /opt/bitnami/apache/conf/httpd.conf "${path_backup}"
  cp /opt/bitnami/apache/conf/bitnami/bitnami-ssl.conf "${path_backup}"
  cp /opt/bitnami/php/etc/php.ini "${path_backup}"
  cp /opt/bitnami/mysql/conf/my.cnf "${path_backup}"
fi

"${path_mysqldump}" --defaults-extra-file="${path_mysqldump_cnf}" ${db_name} --no-tablespaces -ce > "${path_backup}/mysqldump.sql"

touch "${HOME}/${filename_prefix_backup}.tar.gz"

chmod 600 "${HOME}/${filename_prefix_backup}.tar.gz"

sudo tar -czf "${HOME}/${filename_prefix_backup}.tar.gz" -C "${path_backup}" .

if [ -n "${bool_encrypt_backup}" ]
then
  touch "${HOME}/${filename_prefix_backup}_enc.tar.gz"

  chmod 600 "${HOME}/${filename_prefix_backup}_enc.tar.gz"

  openssl enc -e -a -md sha512 -pbkdf2 -iter 100000 -salt -AES-256-CBC -pass "pass:${encryption_key}" -in "${HOME}/${filename_prefix_backup}.tar.gz" -out "${HOME}/${filename_prefix_backup}_enc.tar.gz"

  sudo rm "${HOME}/${filename_prefix_backup}.tar.gz"
  mv "${HOME}/${filename_prefix_backup}_enc.tar.gz" "${HOME}/${filename_prefix_backup}.tar.gz"
fi

mv "${HOME}/${filename_prefix_backup}.tar.gz" "${HOME}/${filename_prefix_backup}${filename_suffix_backup}.tar.gz"

folder_id=`"${path_gdrive}" list -m 1000 -n -q 'trashed = false' | grep -m 1 "${gdrive_backup_dirname}" | head -1 | cut -d ' ' -f1`

if [ -z "${folder_id}" ]
then
  "${path_gdrive}" folder -t "${gdrive_backup_dirname}"
  folder_id=`"${path_gdrive}" list -m 1000 -n -q 'trashed = false' | grep -m 1 "${gdrive_backup_dirname}" | head -1 | cut -d ' ' -f1`
fi

"${path_gdrive}" upload --file "${HOME}/${filename_prefix_backup}${filename_suffix_backup}.tar.gz" --parent "${folder_id}"

sudo rm -rf "${path_backup}"
sudo rm "${HOME}/${filename_prefix_backup}"*.tar.gz

expired_file_ids=`"${path_gdrive}" list -m 1000 -n -q "'${folder_id}' in parents and trashed = false and mimeType != 'application/vnd.google-apps.folder'" | sort -k 2r | tail -n +"${num_files_to_retain}" | cut -d ' ' -f1`

if [ -n "${expired_file_ids}" ]
then
  while read -r file_id; do
    "${path_gdrive}" delete --id "${file_id}"
  done <<< "${expired_file_ids}"
fi

Google Drive

In order for the script to communicate with Google Drive, it has a dependency on a freely available binary on GitHub. The following commands download the binary to a new subdirectory under home named “bin”.

cd ~
mkdir -m 700 ~/bin
cd ~/bin
wget -O drive https://drive.google.com/uc?id=0B3X9GlR6Embnb095MGxEYmJhY2c
chmod 500 ~/bin/drive

Execute the binary once it is downloaded and follow the directions to grant it permission to Google Drive.

~/bin/drive

Go to the following link in your browser:

Enter verification code:

Scheduling

Now that the script and supporting files are set up, the following commands are used to schedule the script in the user crontab. The following example schedules the script to run a full encrypted backup once per month on the 1st of the month at 1 AM and a database only encrypted backup runs every day at 2 AM. The full backup is uploaded to a Google Drive folder named “backup_full-example-com” and the five most recent backups are retained. The database only backup is uploaded to a Google Drive folder named “backup_db_only-example-com” and the thirty most recent backups are retained. Since the script depends on other binaries, e.g. mysqldump and drive, please make sure cron has access to the appropriate user path. If it doesn’t have access to the appropriate path, then add it to the crontab. Use the command env $PATH todisplay the current user path and replace the example below with the appropriate path for the environment.

env $PATH

crontab -e

PATH=$PATH:/home/bitnami/bin:/opt/bitnami/mysql/bin

0 1 * * 1 /home/bitnami/scripts/backup.sh -e -f -n 5 -d backup_full-example-com
0 2 * * * /home/bitnami/scripts/backup.sh -e -n 30 -d backup_db_only-example-com

crontab -l

Decrypting

Let’s assume everything is executing as expected and Google Drive is populated with backups from the script. Download a backup from Google Drive to your local machine. Since the file is encrypted, you won’t be able to open it directly. In order to decrypt the file, OpenSSL is used with the -d flag and the same options that were used to encrypt it. Specify the filename of the downloaded encrypted file with the -in option and the filename of resulting decrypted file in the -out option. When prompted, please be sure to enter the same password used by the script to encrypt the file (found in the .backup.cnf file). If you are downloading/decrypting on a Windows machine, you will need to install OpenSSL.

openssl enc -d -a -md sha512 -pbkdf2 -iter 100000 -salt -AES-256-CBC -in "c:\backup_full-example-com_2021_03_23_01_00.tar.gz" -out "c:\decrypted_backup_full-example-com_2021_03_23_01_00.tar.gz"

The resulting decrypted file is now readable as a regular tar.gz file.

Using Self-Signed S/MIME Certificates in Thunderbird

Part 1 – Trusting Self-Signed S/MIME Personal Certificates

Step 1 – Account Settings

Step 2 – End-To-End Encryption

Step 3 – Establish Personal Certificate Trust

Step 4 – Establish Certificate Authority Trust

Step 5 – S/MIME Settings for Digital Signing and Encryption

Part 2 – Sending a Digitally Signed and Encrypted Message

Step 1 – Draft New Message

Step 2 – Set Security Options

Step 3 – Send Message

Result

Further Reading

Using Self-Signed S/MIME Certificates in Outlook

Part 1 – Trusting the Self-Signed Certificate Authority

Step 1 – Install Certificate

Step 2 – Select Store Location

Step 3 – Select Certificate Store

Step 4 – Complete the Certificate Import Wizard

Step 5 – Security Warning

Step 6 – Confirm Trusted Certification Authorities in CertMgr

Part 2 – Installing the Self-Signed S/MIME Certificate in Outlook

Step 1 – Open Trust Center

Step 2 – Open Email Security

Step 3 – Import Self-Signed S/MIME Certificate

Step 4 – Import Certificate

Step 5 – Change Security Settings

Step 6 – Confirm Default Settings

Part 3 – Sending a Digitally Signed E-mail

Step 1 – Draft and Sign E-mail

Step 2 – Send E-mail

Result

Part 4 – Establishing Recipient Trust

Step 1 – Invalid Digital Signature

Step 2 – Message Security Properties (Invalid)

Step 3 – Trust Certificate Authority

Step 4 – View Certificate and Edit Trust

Step 5 – Message Security Properties (Valid)

Step 6 – Valid and Trusted Digital Signature

Further Reading