Encrypting E-Mail for Added Security

191

That’s all there is to it. Encryption is a quick, easy way to keep personal documents private — only people with your passphrase can read encrypted files. If you do a good job keeping that passphrase private, no one other than you can access the files you want to keep to yourself.

Encrypting E-Mail for

Added Security

Public-key cryptography can help secure your e-mail in two ways:

When you send e-mail, encrypt the message with the recipient’s public key to ensure that only the recipient can read it.

Sign the message with your private key, and the recipient can verify that the message really came from you by validating the signature against your public key.

Encrypting an e-mail document ensures that anyone watching the bits fly by on the Web won’t be reading your sensitive information. The only person who can read the encrypted message is the person holding the private key.

A digital signature seals an e-mail document. If the document is changed in any way, the signature will be disturbed, and the recipient will know about it. When you sign a document, you sign it with your private key. The recipient then uses your public key to verify that the digital signature is authentic and hasn’t been tampered with.

The Mozilla e-mail client and Evolution e-mail client both support public-key encryption. The built-in support makes it easy (and quick) to send and receive encrypted e-mail and to apply and verify digital signatures.

Encrypting with Ximian Evolution

incoming letters is a snap. If you’ve followed the steps in the section titled “Creating keys with kgpg” at the beginning of this technique, Evolution knows how to find your gpg key ring, and can use the keys on it to encrypt and decrypt e-mail with a simple click and a passphrase.

If you’re not already using Evolution, the setup wizard will set you up in a few simple steps. Answer the questions, and you’ll be up and running in no time!

To send an encrypted e-mail with Evolution, follow these steps:

1. Open Evolution:

If you’re using Fedora, open the main menu and choose Internet Evolution Email to start the Evolution e-mail client.

If you’re a Mandrake user, open the main menu and choose Internet Main Evolution.

On SuSE, open the main menu and choose Internet E-Mail Ximian Evolution.

2. Click New to create a new e-mail.

3. Type the recipient’s address and your message.

4. Click Security (on the menu bar), and choose

GPG Encrypt to encrypt the message and GPG Sign if you want to sign the message.

Sending an encrypted e-mail encrypts it with the recipient’s public key. You have to have the public key in your key ring; if it’s not in your key ring, you get an error message.

5. Click Send.

The Enter Password dialog appears, waiting for your gpg passphrase (see Figure 28-8).

6. Enter your passphrase and click OK.

That’s all there is to it. The encrypted and signed e-mail is sent on its way.

If you’re already using Evolution to manage your	Opening an encrypted document with Evolution is
e-mail, adding a bit of security to your outgoing and	just as easy as sending one:

192 Technique 28: Using Encryption for Extra Security

•Figure 28-8: The Enter Password dialog.

1.When an encrypted e-mail arrives in your mailbox, click the message.

A dialog appears, prompting you for your gpg passphrase.

2.Enter your passphrase.

Evolution now has access to your key ring until you close the session.

The message automatically decrypts and opens.

3.If the message was signed, click the lock icon next to the signature to verify the signature.

Evolution tells you whether or not the signature is good.

Setting up Mozilla e-mail for encryption

Mozilla e-mail can send encrypted e-mail just as easily as Evolution, but before it’s ready to deal with encryption, you need to download and install a plugin. (Plug-ins are snippets of code that enhance the features offered by a program.)

Follow these steps to download and install the Enigmail plug-in:

1. Open your terminal window and give yourself superuser privileges with the following command:

2. Enter your superuser password when prompted.

3. Type mozilla in the command line and press

Enter.

You need superuser privileges to install the plug-in, so opening the browser with those privileges transfers the privileges to the browser.

4. Navigate to enigmail.mozdev.org.

5. Click the Download link in the Resources list near the top of the page.

6. Scroll down and choose your download from the versions listed under Standard Download.

Choose the download that most closely matches the version of Mozilla that you’re using.

To find your Mozilla version, choose Help

About Mozilla.

7. Click the Install button for the Linux version that matches your computer.

If can’t find an installer for Fedora, Red Hat 9 is close enough.

A dialog appears, stating that a Web site is requesting permission to install.

8. Click the Install button.

After some whirring and clicking, the browser informs you that Enigmail installation has completed successfully.

9. Restart Mozilla at the command line (still with superuser privileges) to complete the installation.

Now it’s time to configure Enigmail:

1. Open the Edit menu and choose Preferences.

The Preferences dialog appears.

$ su

Encrypting E-Mail for Added Security

193

2. Choose Privacy & Security Enigmail.

The Enigmail Preferences dialog appears, as shown in Figure 28-9.

3. Check the Use From E-Mail Address for Signing to Determine GPG Key box.

•Figure 28-9: The Enigmail Preferences dialog.

4.Select a default encryption type.

Your options are No Default Encryption, Encrypt if Possible, or Encrypt + Sign if Possible.

5.Click OK to save your preferences.

The Enigmail plug-in is installed and configured. You’re now ready to send encrypted e-mail with Mozilla!

Sending and receiving encrypted messages with Mozilla mail

To send an encrypted and signed message with Mozilla and Enigmail, follow these steps:

1. Open Mozilla’s Window menu and choose Mail and Newsgroups.

The Mozilla mail client appears

2. Click the Compose icon (on the toolbar).

3. Compose an e-mail message as you normally would.

4. When your message is complete, choose

Enigmail from the menu bar.

The encryption options appear in the Enigmail menu, as shown in Figure 28-10.

• Figure 28-10: The Compose/Enigmail menu options.

5. Choose a message type from the drop-down menu. Choose either Encrypted Send or Encrypt + Sign Send.

If you sign an e-mail, the recipient needs your public key to verify the signature.

6. Enter your passphrase when prompted and click OK.

Your message is on its way!

When an encrypted e-mail arrives in your inbox, Enigmail automatically decrypts it and verifies the signature. The signature status is shown in the message header, right above the subject line.

If a message does not automatically decrypt, you may need to select Automatically Decrypt/ Verify Messages from the Enigmail menu.

A new message window opens.

29 Securing a Large

Network with Custom

Technique Authentication

Save Time By

Using cross-platform authentication to keep user information centralized

Using Kerberos with PAM for simple and secure third-party authentication

If you have more than a handful of computers in your local network, you know the routine: Each time you connect to a different system, you have to type in your user name and password. Chances are, you use the same

password to log in to most servers, but you haven’t gotten around to synchronizing all your passwords (or maybe you don’t want to use the same password everywhere, just in case someone discovers it). Keeping your passwords straight is a hassle and a good way to waste time.

In this technique, we introduce you to some simple (but powerful) tools that can make network-wide authentication safe and easy by

Streamlining password setup and maintenance: If you’re the administrator of a large network, using cross-platform authentication can save you time. With only one password file to maintain, you save time not only in setup but also in maintenance — the fewer files you maintain, the less chance you’ll make a mistake while updating information.

Creating a secure, network-wide login system that’s more user

friendly: When you’re finished with this technique, you’ll have a login system that requires only one login and one password to access any authorized server on your network.

To build a better login, all you need are PAM and Kerberos. First, we show you how to use PAM authentication to access the user database on a Windows machine to authenticate Linux users. Sacrilegious? Not if you already have a Windows domain and you’re slowly adding Linux computers.

Kerberos — a secure, single-login, network-wide authentication service — adds security to the mix. When you login to a kerberized network, you give your user name and password to the Key Distribution Center (KDC), and in return, you receive a ticket that you can give to other kerberized servers. A Kerberos ticket is like a passport. The KDC verifies your identity and then gives you a set of credentials that you can hand to other servers: If the server trusts the KDC, it accepts your credentials.

By using PAM with Kerberos, you get automagic ticket handling. With one login, you have access to all the kerberized servers on your network.